Refactor conference authentication on the backend side

This removes massive amounts of duplicated code to check that "is the
user either a superuser or an admin for this conference". Centralizing
that into the get_authenticated_conference() functions simplifies things
a lot, and deleted code is always the best type of code.

diff --git a/postgresqleu/confreg/feedback.py b/postgresqleu/confreg/feedback.py
index ff64d40e1091c989bb324a358e581f0f261cdc20..7e267f011fa9b8bf89cf32a8646b965b2de0e361 100644 (file)
--- a/postgresqleu/confreg/feedback.py
+++ b/postgresqleu/confreg/feedback.py
@@ -1,9 +1,9 @@
-from django.shortcuts import render, get_object_or_404
-from django.contrib.auth.decorators import login_required
+from django.shortcuts import render
 from django.db.models import Count
 from django.db import connection
 
 from models import Conference, ConferenceFeedbackQuestion, ConferenceFeedbackAnswer
+from backendviews import get_authenticated_conference
 
 from collections import OrderedDict
 
@@ -28,12 +28,8 @@ def build_feedback_response(question):
                r['graphdata'] = build_graphdata(question, 'rateanswer', range(0,6))
        return r
 
-@login_required
 def feedback_report(request, confname):
-       if request.user.is_superuser:
-               conference = get_object_or_404(Conference, urlname=confname)
-       else:
-               conference = get_object_or_404(Conference, urlname=confname, administrators=request.user)
+       conference = get_authenticated_conference(request, confname)
 
        sections = []
        # Get the global conference feedback. Yes, this will be inefficient, but it will work
@@ -65,12 +61,8 @@ def build_toplists(what, query):
                tl['list'] = cursor.fetchall()
                yield tl
 
-@login_required
 def feedback_sessions(request, confname):
-       if request.user.is_superuser:
-               conference = get_object_or_404(Conference, urlname=confname)
-       else:
-               conference = get_object_or_404(Conference, urlname=confname, administrators=request.user)
+       conference = get_authenticated_conference(request, confname)
 
        # Get all sessions that have actual comments on them
        cursor = connection.cursor()

diff --git a/postgresqleu/confreg/pdfschedule.py b/postgresqleu/confreg/pdfschedule.py
index fb9bb0cffd7460f1755a7570b798a6920f6b0414..d84886bc3df5f136438f5d00548b957ae1d1a1cc 100644 (file)
--- a/postgresqleu/confreg/pdfschedule.py
+++ b/postgresqleu/confreg/pdfschedule.py
@@ -1,6 +1,5 @@
 #!/usr/bin/env python
 # -*- coding: utf-8 -*-
-from django.contrib.auth.decorators import login_required
 from django.shortcuts import get_object_or_404
 from django.shortcuts import render
 from django import forms
@@ -22,6 +21,7 @@ from reportlab.lib.styles import getSampleStyleSheet
 from reportlab.lib.units import cm, mm
 
 from models import Conference, Room, Track, RegistrationDay, ConferenceSession
+from backendviews import get_authenticated_conference
 
 def _get_pagesize(size, orient):
        so = (size, orient)
@@ -329,12 +329,8 @@ class PdfScheduleForm(forms.Form):
                self.fields['day'].queryset = RegistrationDay.objects.filter(conference=conference)
                self.fields['tracks'].queryset = alltracks
 
-@login_required
 def pdfschedule(request, confname):
-       if request.user.is_superuser:
-               conference = get_object_or_404(Conference, urlname=confname)
-       else:
-               conference = get_object_or_404(Conference, urlname=confname, administrators=request.user)
+       conference = get_authenticated_conference(request, confname)
 
        if request.method == "POST":
                form = PdfScheduleForm(conference, data=request.POST)

diff --git a/postgresqleu/confreg/views.py b/postgresqleu/confreg/views.py
index 016666b3194662c4c8cbae89bee700594f58cde7..de5af6c315f8a95ecc44dad1c7e404246fe8c52f 100644 (file)
--- a/postgresqleu/confreg/views.py
+++ b/postgresqleu/confreg/views.py
@@ -39,6 +39,7 @@ from util import get_invoice_autocancel, cancel_registration
 from models import get_status_string
 from regtypes import confirm_special_reg_type, validate_special_reg_type
 from jinjafunc import render_jinja_conference_response, JINJA_TEMPLATE_ROOT
+from backendviews import get_authenticated_conference
 
 from postgresqleu.util.decorators import user_passes_test_or_error
 from postgresqleu.util.random import generate_random_token
@@ -999,12 +1000,8 @@ def schedule(request, confname):
 
        return render_conference_response(request, conference, 'schedule', 'confreg/schedule.html', _scheduledata(request, conference))
 
-@login_required
 def schedulejson(request, confname):
-       if request.user.is_superuser:
-               conference = get_object_or_404(Conference, urlname=confname)
-       else:
-               conference = get_object_or_404(Conference, urlname=confname, administrators=request.user)
+       conference = get_authenticated_conference(request, confname)
 
        return HttpResponse(json.dumps(_scheduledata(request, conference),
                                                                   cls=JsonSerializer,
@@ -1761,13 +1758,9 @@ def optout(request, token):
                'series': series,
        })
 
-@login_required
 @transaction.atomic
 def createvouchers(request, confname):
-       if request.user.is_superuser:
-               conference = get_object_or_404(Conference, urlname=confname)
-       else:
-               conference = get_object_or_404(Conference, urlname=confname, administrators=request.user)
+       conference = get_authenticated_conference(request, confname)
 
        # Creation of pre-paid vouchers for conference registrations
        if request.method == 'POST':
@@ -1828,12 +1821,8 @@ def createvouchers(request, confname):
                'breadcrumbs': (('/events/admin/{0}/prepaid/list/'.format(conference.urlname), 'Prepaid vouchers'),),
        })
 
-@login_required
 def listvouchers(request, confname):
-       if request.user.is_superuser:
-               conference = get_object_or_404(Conference, urlname=confname)
-       else:
-               conference = get_object_or_404(Conference, urlname=confname, administrators=request.user)
+       conference = get_authenticated_conference(request, confname)
 
        batches = PrepaidBatch.objects.select_related('regtype').filter(conference=conference).prefetch_related('prepaidvoucher_set')
 
@@ -1842,12 +1831,8 @@ def listvouchers(request, confname):
                'batches': batches,
        })
 
-@login_required
 def viewvouchers(request, confname, batchid):
-       if request.user.is_superuser:
-               conference = get_object_or_404(Conference, urlname=confname)
-       else:
-               conference = get_object_or_404(Conference, urlname=confname, administrators=request.user)
+       conference = get_authenticated_conference(request, confname)
 
        batch = get_object_or_404(PrepaidBatch, conference=conference, pk=batchid)
        vouchers = batch.prepaidvoucher_set.all()
@@ -1866,13 +1851,9 @@ def viewvouchers(request, confname, batchid):
                'breadcrumbs': (('/events/admin/{0}/prepaid/list/'.format(conference.urlname), 'Prepaid vouchers'),),
        })
 
-@login_required
 @transaction.atomic
 def delvouchers(request, confname, batchid, voucherid):
-       if request.user.is_superuser:
-               conference = get_object_or_404(Conference, urlname=confname)
-       else:
-               conference = get_object_or_404(Conference, urlname=confname, administrators=request.user)
+       conference = get_authenticated_conference(request, confname)
 
        batch = get_object_or_404(PrepaidBatch, conference=conference, pk=batchid)
        voucher = get_object_or_404(PrepaidVoucher, batch=batch, pk=voucherid)
@@ -1904,12 +1885,8 @@ def viewvouchers_user(request, confname, batchid):
                'vouchers': vouchers,
        })
 
-@login_required
 def emailvouchers(request, confname, batchid):
-       if request.user.is_superuser:
-               conference = get_object_or_404(Conference, urlname=confname)
-       else:
-               conference = get_object_or_404(Conference, urlname=confname, administrators=request.user)
+       conference = get_authenticated_conference(request, confname)
 
        batch = PrepaidBatch.objects.get(pk=batchid)
        vouchers = batch.prepaidvoucher_set.all()
@@ -2321,12 +2298,8 @@ def publishschedule(request, confname):
                                'changes': changes,
                        })
 
-@login_required
 def reports(request, confname):
-       if request.user.is_superuser:
-               conference = get_object_or_404(Conference, urlname=confname)
-       else:
-               conference = get_object_or_404(Conference, urlname=confname, administrators=request.user)
+       conference = get_authenticated_conference(request, confname)
 
        # Include information for the advanced reports
        from reports import attendee_report_fields, attendee_report_filters
@@ -2338,12 +2311,8 @@ def reports(request, confname):
                    })
 
 
-@login_required
 def advanced_report(request, confname):
-       if request.user.is_superuser:
-               conference = get_object_or_404(Conference, urlname=confname)
-       else:
-               conference = get_object_or_404(Conference, urlname=confname, administrators=request.user)
+       conference = get_authenticated_conference(request, confname)
 
        if request.method != "POST":
                raise Http404()
@@ -2353,12 +2322,8 @@ def advanced_report(request, confname):
        return build_attendee_report(conference, request.POST )
 
 
-@login_required
 def simple_report(request, confname):
-       if request.user.is_superuser:
-               conference = get_object_or_404(Conference, urlname=confname)
-       else:
-               conference = get_object_or_404(Conference, urlname=confname, administrators=request.user)
+       conference = get_authenticated_conference(request, confname)
 
        from reports import simple_reports
 
@@ -2412,12 +2377,8 @@ def admin_dashboard(request):
                'past': past,
        })
 
-@login_required
 def admin_dashboard_single(request, urlname):
-       if request.user.is_superuser:
-               conference = get_object_or_404(Conference, urlname=urlname)
-       else:
-               conference = get_object_or_404(Conference, urlname=urlname, administrators=request.user)
+       conference = get_authenticated_conference(request, urlname)
 
        return render(request, 'confreg/admin_dashboard_single.html', {
                'c': conference,
@@ -2431,12 +2392,8 @@ def admin_dashboard_single(request, urlname):
                'pending_sessions': conditional_exec_to_scalar(conference.scheduleactive, "SELECT EXISTS (SELECT 1 FROM confreg_conferencesession s WHERE s.conference_id=%(confid)s AND s.status=0)", {'confid': conference.id}),
        })
 
-@login_required
 def admin_registration_dashboard(request, urlname):
-       if request.user.is_superuser:
-               conference = get_object_or_404(Conference, urlname=urlname)
-       else:
-               conference = get_object_or_404(Conference, urlname=urlname, administrators=request.user)
+       conference = get_authenticated_conference(request, urlname)
 
        curs = connection.cursor()
 
@@ -2486,12 +2443,8 @@ def admin_registration_dashboard(request, urlname):
                'tables': tables,
        })
 
-@login_required
 def admin_registration_list(request, urlname):
-       if request.user.is_superuser:
-               conference = get_object_or_404(Conference, urlname=urlname)
-       else:
-               conference = get_object_or_404(Conference, urlname=urlname, administrators=request.user)
+       conference = get_authenticated_conference(request, urlname)
 
        skey = request.GET.get('sort', '-date')
        if skey[0] == '-':
@@ -2519,12 +2472,8 @@ def admin_registration_list(request, urlname):
                'breadcrumbs': (('/events/admin/{0}/regdashboard/'.format(urlname), 'Registration dashboard'),),
        })
 
-@login_required
 def admin_registration_single(request, urlname, regid):
-       if request.user.is_superuser:
-               conference = get_object_or_404(Conference, urlname=urlname)
-       else:
-               conference = get_object_or_404(Conference, urlname=urlname, administrators=request.user)
+       conference = get_authenticated_conference(request, urlname)
 
        reg = get_object_or_404(ConferenceRegistration, id=regid, conference=conference)
 
@@ -2543,13 +2492,9 @@ def admin_registration_single(request, urlname, regid):
                ),
        })
 
-@login_required
 @transaction.atomic
 def admin_registration_cancel(request, urlname, regid):
-       if request.user.is_superuser:
-               conference = get_object_or_404(Conference, urlname=urlname)
-       else:
-               conference = get_object_or_404(Conference, urlname=urlname, administrators=request.user)
+       conference = get_authenticated_conference(request, urlname)
 
        reg = get_object_or_404(ConferenceRegistration, id=regid, conference=conference)
 
@@ -2566,13 +2511,9 @@ def admin_registration_cancel(request, urlname, regid):
                        'reg': reg,
                })
 
-@login_required
 @transaction.atomic
 def admin_waitlist(request, urlname):
-       if request.user.is_superuser:
-               conference = get_object_or_404(Conference, urlname=urlname)
-       else:
-               conference = get_object_or_404(Conference, urlname=urlname, administrators=request.user)
+       conference = get_authenticated_conference(request, urlname)
 
        if conference.attendees_before_waitlist <= 0:
                return render(request, 'confreg/admin_waitlist_inactive.html', {
@@ -2634,13 +2575,9 @@ def admin_waitlist(request, urlname):
                'form': form,
                })
 
-@login_required
 @transaction.atomic
 def admin_waitlist_cancel(request, urlname, wlid):
-       if request.user.is_superuser:
-               conference = get_object_or_404(Conference, urlname=urlname)
-       else:
-               conference = get_object_or_404(Conference, urlname=urlname, administrators=request.user)
+       conference = get_authenticated_conference(request, urlname)
 
        wl = get_object_or_404(RegistrationWaitlistEntry, pk=wlid, registration__conference=conference)
        reg = wl.registration
@@ -2668,13 +2605,9 @@ def admin_waitlist_cancel(request, urlname, wlid):
        return HttpResponseRedirect("../../")
 
 
-@login_required
 @transaction.atomic
 def admin_attendeemail(request, urlname):
-       if request.user.is_superuser:
-               conference = get_object_or_404(Conference, urlname=urlname)
-       else:
-               conference = get_object_or_404(Conference, urlname=urlname, administrators=request.user)
+       conference = get_authenticated_conference(request, urlname)
 
        mails = AttendeeMail.objects.filter(conference=conference)
 
@@ -2711,12 +2644,8 @@ def admin_attendeemail(request, urlname):
                'form': form,
        })
 
-@login_required
 def admin_attendeemail_view(request, urlname, mailid):
-       if request.user.is_superuser:
-               conference = get_object_or_404(Conference, urlname=urlname)
-       else:
-               conference = get_object_or_404(Conference, urlname=urlname, administrators=request.user)
+       conference = get_authenticated_conference(request, urlname)
 
        mail = get_object_or_404(AttendeeMail, conference=conference, pk=mailid)
 
@@ -2726,13 +2655,9 @@ def admin_attendeemail_view(request, urlname, mailid):
                'breadcrumbs': (('/events/admin/{0}/mail/'.format(conference.urlname), 'Attendee emails'), ),
                })
 
-@login_required
 @transaction.atomic
 def session_notify_queue(request, urlname):
-       if request.user.is_superuser:
-               conference = get_object_or_404(Conference, urlname=urlname)
-       else:
-               conference = get_object_or_404(Conference, urlname=urlname, administrators=request.user)
+       conference = get_authenticated_conference(request, urlname)
 
        notifysessions = ConferenceSession.objects.filter(conference=conference).exclude(status=F('lastnotifiedstatus'))
 
@@ -2764,13 +2689,9 @@ def session_notify_queue(request, urlname):
                'notifysessions': notifysessions,
                })
 
-@login_required
 @transaction.atomic
 def transfer_reg(request, urlname):
-       if request.user.is_superuser:
-               conference = get_object_or_404(Conference, urlname=urlname)
-       else:
-               conference = get_object_or_404(Conference, urlname=urlname, administrators=request.user)
+       conference = get_authenticated_conference(request, urlname)
 
        def _make_transfer(fromreg, toreg):
                yield u"Initiating transfer from %s to %s" % (fromreg.fullname, toreg.fullname)

diff --git a/postgresqleu/confwiki/views.py b/postgresqleu/confwiki/views.py
index 0986dde727cd53acb67992744d1c4b6a0bd4838c..51631df835686ed0d0001231b2d12d1f933b79e1 100644 (file)
--- a/postgresqleu/confwiki/views.py
+++ b/postgresqleu/confwiki/views.py
@@ -14,6 +14,7 @@ from postgresqleu.mailqueue.util import send_simple_mail
 
 from postgresqleu.confreg.models import Conference, ConferenceRegistration
 from postgresqleu.confreg.views import render_conference_response
+from postgresqleu.confreg.backendviews import get_authenticated_conference
 
 from postgresqleu.util.db import exec_to_scalar, exec_to_list
 
@@ -182,12 +183,8 @@ def wikipage_edit(request, confurl, wikiurl):
                'diff': diff,
        })
 
-@login_required
 def admin(request, urlname):
-       if request.user.is_superuser:
-               conference = get_object_or_404(Conference, urlname=urlname)
-       else:
-               conference = get_object_or_404(Conference, urlname=urlname, administrators=request.user)
+       conference = get_authenticated_conference(request, urlname)
 
        pages = Wikipage.objects.filter(conference=conference)
 
@@ -196,13 +193,9 @@ def admin(request, urlname):
                'pages': pages,
        })
 
-@login_required
 @transaction.atomic
 def admin_edit_page(request, urlname, pageid):
-       if request.user.is_superuser:
-               conference = get_object_or_404(Conference, urlname=urlname)
-       else:
-               conference = get_object_or_404(Conference, urlname=urlname, administrators=request.user)
+       conference = get_authenticated_conference(request, urlname)
 
        if pageid != 'new':
                page = get_object_or_404(Wikipage, conference=conference, pk=pageid)
@@ -324,12 +317,8 @@ def signup(request, urlname, signupid):
                'form': form,
        })
 
-@login_required
 def signup_admin(request, urlname):
-       if request.user.is_superuser:
-               conference = get_object_or_404(Conference, urlname=urlname)
-       else:
-               conference = get_object_or_404(Conference, urlname=urlname, administrators=request.user)
+       conference = get_authenticated_conference(request, urlname)
 
        signups = Signup.objects.filter(conference=conference)
 
@@ -338,13 +327,9 @@ def signup_admin(request, urlname):
                'signups': signups,
        })
 
-@login_required
 @transaction.atomic
 def signup_admin_edit(request, urlname, signupid):
-       if request.user.is_superuser:
-               conference = get_object_or_404(Conference, urlname=urlname)
-       else:
-               conference = get_object_or_404(Conference, urlname=urlname, administrators=request.user)
+       conference = get_authenticated_conference(request, urlname)
 
        if signupid != 'new':
                signup = get_object_or_404(Signup, conference=conference, pk=signupid)
@@ -400,13 +385,9 @@ def signup_admin_edit(request, urlname, signupid):
        })
 
 
-@login_required
 @transaction.atomic
 def signup_admin_sendmail(request, urlname, signupid):
-       if request.user.is_superuser:
-               conference = get_object_or_404(Conference, urlname=urlname)
-       else:
-               conference = get_object_or_404(Conference, urlname=urlname, administrators=request.user)
+       conference = get_authenticated_conference(request, urlname)
 
        signup = get_object_or_404(Signup, conference=conference, pk=signupid)