Stop volunteers from accessing admin urls.

Fixes #325

Author: necessary129

vms/administrator/utils.py

@@ -0,0 +1,11 @@
+from functools import wraps
+from django.shortcuts import render
+
+def admin_required(func):
+    @wraps(func)
+    def wrapped_view(request, *args, **kwargs):
+        admin = hasattr(request.user, 'administrator')
+        if not admin:
+            return render(request, 'vms/no_admin_rights.html', status=403)
+        return func(request, *args, **kwargs)
+    return wrapped_view

vms/administrator/views.py

@@ -13,21 +13,17 @@
 from django.views.generic.edit import FormView, UpdateView
 from django.views.generic import View
 from administrator.models import Administrator
+from administrator.utils import admin_required
 from django.utils.decorators import method_decorator
 
 
 class AdministratorLoginRequiredMixin(object):
 
     @method_decorator(login_required)
     def dispatch(self, request, *args, **kwargs):
-        user = request.user
-        admin = None
-        try:
-            admin = user.administrator
-        except ObjectDoesNotExist:
-            pass
+        admin = hasattr(request.user, 'administrator')
         if not admin:
-            return render(request, 'vms/no_admin_rights.html')
+            return render(request, 'vms/no_admin_rights.html', status=403)
         else:
             return super(AdministratorLoginRequiredMixin, self).dispatch(request, *args, **kwargs)
 
@@ -81,14 +77,6 @@ def post(self, request, *args, **kwargs):
 
 
 @login_required
+@admin_required
 def settings(request):
-    user = request.user
-    admin = None
-    try:
-        admin = user.administrator
-    except ObjectDoesNotExist:
-        pass
-    if not admin:
-        return HttpResponse(status=403)
-
     return HttpResponseRedirect(reverse('event:list'))

vms/registration/views.py

@@ -31,6 +31,9 @@ class AdministratorSignupView(TemplateView):
     phone_error = False
 
     def get(self, request):
+        if hasattr(request, 'user'):
+            if not hasattr(request.user, 'administrator'):
+              return render(request, 'vms/no_admin_rights.html', status=403)
         user_form = UserForm(prefix="usr")
         administrator_form = AdministratorForm(prefix="admin")
         return render(request,
@@ -45,6 +48,9 @@ def post(self, request):
         organization_list = get_organizations_ordered_by_name()
         if organization_list:
             if request.method == 'POST':
+                if hasattr(request, 'user'):
+                  if not hasattr(request.user, 'administrator'):
+                    return render(request, 'vms/no_admin_rights.html', status=403)
                 user_form = UserForm(request.POST, prefix="usr")
                 administrator_form = AdministratorForm(request.POST,
                                                        prefix="admin")

vms/volunteer/views.py

@@ -10,6 +10,7 @@
 from django.views.generic.detail import DetailView
 from django.views.generic import ListView
 from braces.views import LoginRequiredMixin, AnonymousRequiredMixin
+from administrator.utils import admin_required
 from organization.services import *
 from shift.services import *
 from event.services import get_signed_up_events_for_volunteer
@@ -162,6 +163,7 @@ def post(self, request, *args, **kwargs):
                        'job_list': job_list, 'event_list': event_list, 'selected_event': event_name,
                        'selected_job': job_name})
 @login_required
+@admin_required
 def search(request):
     if request.method == 'POST':
         form = SearchVolunteerForm(request.POST)