From 8239d6bb80742cf4ca260419a81da48d9f78b038 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Emilio=20A=2E=20S=C3=A1nchez=20L=C3=B3pez?= Date: Tue, 26 Apr 2011 14:28:10 +0000 Subject: [PATCH 1/9] Do not allow cancel submissions with GET requests. See #650 - Legacy-Id: 3061 --- ietf/submit/views.py | 4 +++- ietf/templates/submit/draft_status.html | 12 +++++------- 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/ietf/submit/views.py b/ietf/submit/views.py index c463b0e57..beb83a918 100644 --- a/ietf/submit/views.py +++ b/ietf/submit/views.py @@ -2,7 +2,7 @@ from django.conf import settings from django.core.urlresolvers import reverse from django.contrib.sites.models import Site -from django.http import HttpResponseRedirect, Http404, HttpResponseForbidden +from django.http import HttpResponseRedirect, Http404, HttpResponseForbidden, HttpResponseNotAllowed from django.shortcuts import get_object_or_404 from django.shortcuts import render_to_response from django.template import RequestContext @@ -167,6 +167,8 @@ def draft_status(request, submission_id, submission_hash=None, message=None): def draft_cancel(request, submission_id, submission_hash=None): + if request.method!='POST': + return HttpResponseNotAllowed(['POST']) detail = get_object_or_404(IdSubmissionDetail, submission_id=submission_id) can_cancel = _can_cancel(request.user, detail, submission_hash) if not can_cancel: diff --git a/ietf/templates/submit/draft_status.html b/ietf/templates/submit/draft_status.html index f90af04c6..011402f4e 100644 --- a/ietf/templates/submit/draft_status.html +++ b/ietf/templates/submit/draft_status.html @@ -24,12 +24,8 @@ pre.twopages { margin: 0px; } {% if can_cancel %} {% endif %} @@ -198,7 +194,9 @@ returned to the submitter. {% if can_cancel %}

Cancel submission

-
+

+
+
This submission will be canceled, and its uploaded document(s) permanently deleted.

{% endif %} From 23d0ddf7e4dd6953697d4ebb8c5ef819b71585c9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Emilio=20A=2E=20S=C3=A1nchez=20L=C3=B3pez?= Date: Tue, 26 Apr 2011 14:35:07 +0000 Subject: [PATCH 2/9] Ensure that 'get full url', 'approve' and 'force' views are called via POST request. See #650 - Legacy-Id: 3062 --- ietf/submit/views.py | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/ietf/submit/views.py b/ietf/submit/views.py index beb83a918..497f39724 100644 --- a/ietf/submit/views.py +++ b/ietf/submit/views.py @@ -220,6 +220,8 @@ def draft_confirm(request, submission_id, auth_key): def draft_approve(request, submission_id, check_function=_can_approve): + if request.method!='POST': + return HttpResponseNotAllowed(['POST']) detail = get_object_or_404(IdSubmissionDetail, submission_id=submission_id) can_perform = check_function(request.user, detail) if not can_perform: @@ -231,10 +233,14 @@ def draft_approve(request, submission_id, check_function=_can_approve): def draft_force(request, submission_id): + if request.method!='POST': + return HttpResponseNotAllowed(['POST']) return draft_approve(request, submission_id, check_function=_can_force_post) def full_url_request(request, submission_id): + if request.method!='POST': + return HttpResponseNotAllowed(['POST']) detail = get_object_or_404(IdSubmissionDetail, submission_id=submission_id) request_full_url(request, detail) message = ('success', 'An email has been sent to draft authors to inform them of the full access url') From af039fba02e87c4d796abd10850a90ffdae666a9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Emilio=20A=2E=20S=C3=A1nchez=20L=C3=B3pez?= Date: Tue, 26 Apr 2011 14:43:08 +0000 Subject: [PATCH 3/9] Do not assume that the two_pages_field field is not None. Fixes #651 - Legacy-Id: 3063 --- ietf/submit/templatetags/submit_tags.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ietf/submit/templatetags/submit_tags.py b/ietf/submit/templatetags/submit_tags.py index f406660c9..ce2da673c 100644 --- a/ietf/submit/templatetags/submit_tags.py +++ b/ietf/submit/templatetags/submit_tags.py @@ -23,7 +23,7 @@ def show_two_pages(context, two_pages, validation): @register.filter def two_pages_decorated_with_validation(value, validation): - pages = value.first_two_pages + pages = value.first_two_pages or '' if not 'revision' in validation.warnings.keys(): return mark_safe('' % pages) result = '