Bugfix: Acesso sem selecionar fazenda
As ListViews não verificavam a existência de uma fazenda selecionada antes de exibir seu conteúdo, permitindo um acesso não intencionado
This commit is contained in:
1 parent
d3648237fb
commit
d7887019f7
1 file changed
+7
-2
@@ -1,6 +1,7 @@
|
|||||||
from django.views.generic import ListView
|
from django.views.generic import ListView
|
||||||
from django.db.models import Q
|
from django.db.models import Q
|
||||||
from entities.models.farm import Farm
|
from entities.models.farm import Farm
|
||||||
|
from django.shortcuts import redirect
|
||||||
|
|
||||||
class BaseListView(ListView):
|
class BaseListView(ListView):
|
||||||
template_name = "entity_list.html"
|
template_name = "entity_list.html"
|
||||||
@@ -21,8 +22,12 @@ class BaseListView(ListView):
|
|||||||
|
|
||||||
# Acts like a init function - provides the select_farm Farm object to all dependent views
|
# Acts like a init function - provides the select_farm Farm object to all dependent views
|
||||||
def dispatch(self, request, *args, **kwargs):
|
def dispatch(self, request, *args, **kwargs):
|
||||||
farm_id = self.request.session.get('selected_farm_id')
|
try: # Prevents Django from loading the page without a selected farm
|
||||||
self.selected_farm = Farm.objects.filter(id=farm_id).first()
|
farm_id = request.session['selected_farm_id']
|
||||||
|
except KeyError:
|
||||||
|
return redirect('entities:user:farm_select')
|
||||||
|
|
||||||
|
self.selected_farm = Farm.objects.filter(id=farm_id, users=request.user).first()
|
||||||
return super().dispatch(request, *args, **kwargs)
|
return super().dispatch(request, *args, **kwargs)
|
||||||
|
|
||||||
# Filter
|
# Filter
|
||||||
|
|||||||
Reference in new issue
Block a user