OSQA-696, user profile URLs shouldn't be arbitrary, comparing the passed slug and...

git-svn-id: http://svn.osqa.net/svnroot/osqa/trunk@1135 0cfe37f9-358a-4d5e-be75-b63607b5c754

diff --git a/forum/views/users.py b/forum/views/users.py
index 3b863da1611e1f989b5eee538ee9c48a7c700ec0..cf9b3732a363bc4f857e57f80820b67d860d6a88 100644 (file)
--- a/forum/views/users.py
+++ b/forum/views/users.py
@@ -272,13 +272,23 @@ def user_view(template, tab_name, tab_title, tab_description, private=False, tab
             if render_to and (not render_to(user)):\r
                 raise ReturnImediatelyException(HttpResponseRedirect(user.get_profile_url()))\r
 \r
-            return [request, user], {}\r
+            return [request, user], { 'slug' : slug, }\r
 \r
         decorated = decorate.params.withfn(params)(fn)\r
 \r
-        def result(context, request, user):\r
+        def result(context_or_response, request, user, **kwargs):\r
             rev_page_title = smart_unicode(user.username) + " - " + tab_description\r
 \r
+            # Check whether the return type of the decorated function is a context or Http Response\r
+            if isinstance(context_or_response, HttpResponse):\r
+                response = context_or_response\r
+\r
+                # If it is a response -- show it\r
+                return response\r
+            else:\r
+                # ...if it is a context move forward, update it and render it to response\r
+                context = context_or_response\r
+\r
             context.update({\r
                 "tab": "users",\r
                 "active_tab" : tab_name,\r
@@ -306,10 +316,15 @@ def user_view(template, tab_name, tab_title, tab_description, private=False, tab
 \r
 \r
 @user_view('users/stats.html', 'stats', _('overview'), _('user overview'))\r
-def user_profile(request, user):\r
+def user_profile(request, user, **kwargs):\r
     questions = Question.objects.filter_state(deleted=False).filter(author=user).order_by('-added_at')\r
     answers = Answer.objects.filter_state(deleted=False).filter(author=user).order_by('-added_at')\r
 \r
+    # Check whether the passed slug matches the one for the user object\r
+    slug = kwargs['slug']\r
+    if slug != slugify(smart_unicode(user.username)):\r
+        return HttpResponseRedirect(user.get_absolute_url())\r
+\r
     up_votes = user.vote_up_count\r
     down_votes = user.vote_down_count\r
     votes_today = user.get_vote_count_today()\r
@@ -338,7 +353,7 @@ def user_profile(request, user):
     })\r
     \r
 @user_view('users/recent.html', 'recent', _('recent activity'), _('recent user activity'))\r
-def user_recent(request, user):\r
+def user_recent(request, user, **kwargs):\r
     activities = user.actions.exclude(\r
             action_type__in=("voteup", "votedown", "voteupcomment", "flag", "newpage", "editpage")).order_by(\r
             '-action_date')[:USERS_PAGE_SIZE]\r
@@ -347,7 +362,7 @@ def user_recent(request, user):
 \r
 \r
 @user_view('users/reputation.html', 'reputation', _('reputation history'), _('graph of user karma'))\r
-def user_reputation(request, user):\r
+def user_reputation(request, user, **kwargs):\r
     rep = list(user.reputes.order_by('date'))\r
     values = [r.value for r in rep]\r
     redux = lambda x, y: x+y\r
@@ -362,20 +377,20 @@ def user_reputation(request, user):
     return {"view_user": user, "reputation": rep, "graph_data": graph_data}\r
 \r
 @user_view('users/votes.html', 'votes', _('votes'), _('user vote record'), True)\r
-def user_votes(request, user):\r
+def user_votes(request, user, **kwargs):\r
     votes = user.votes.exclude(node__state_string__contains="(deleted").filter(\r
             node__node_type__in=("question", "answer")).order_by('-voted_at')[:USERS_PAGE_SIZE]\r
 \r
     return {"view_user" : user, "votes" : votes}\r
 \r
 @user_view('users/questions.html', 'favorites', _('favorites'), _('questions that user selected as his/her favorite'))\r
-def user_favorites(request, user):\r
+def user_favorites(request, user, **kwargs):\r
     favorites = FavoriteAction.objects.filter(canceled=False, user=user)\r
 \r
     return {"favorites" : favorites, "view_user" : user}\r
 \r
 @user_view('users/subscriptions.html', 'subscriptions', _('subscription'), _('subscriptions'), True, tabbed=False)\r
-def user_subscriptions(request, user):\r
+def user_subscriptions(request, user, **kwargs):\r
     enabled = True\r
 \r
     tab = request.GET.get('tab', "settings")\r
@@ -433,7 +448,7 @@ def user_subscriptions(request, user):
 \r
 \r
 @user_view('users/preferences.html', 'preferences', _('preferences'), _('preferences'), True, tabbed=False)\r
-def user_preferences(request, user):\r
+def user_preferences(request, user, **kwargs):\r
     if request.POST:\r
         form = UserPreferencesForm(request.POST)\r
 \r