Explicitly allow only POST and GET requests

[astakos] / snf-astakos-app / astakos / im / views.py

diff --git a/snf-astakos-app/astakos/im/views.py b/snf-astakos-app/astakos/im/views.py
index 137711c..f12e356 100644 (file)
--- a/snf-astakos-app/astakos/im/views.py
+++ b/snf-astakos-app/astakos/im/views.py
@@ -53,6 +53,7 @@ from django.db.utils import IntegrityError
 from django.contrib.auth.views import password_change
 from django.core.exceptions import ValidationError
 from django.db.models import Q
+from django.views.decorators.http import require_http_methods
 
 from astakos.im.models import AstakosUser, Invitation, ApprovalTerms
 from astakos.im.activation_backends import get_backend, SimpleBackend
@@ -109,6 +110,7 @@ def signed_terms_required(func):
         return func(request, *args, **kwargs)
     return wrapper
 
+@require_http_methods(["GET", "POST"])
 @signed_terms_required
 def index(request, login_template_name='im/login.html', profile_template_name='im/profile.html', extra_context={}):
     """
@@ -139,6 +141,7 @@ def index(request, login_template_name='im/login.html', profile_template_name='i
                            login_form = LoginForm(request=request),
                            context_instance = get_context(request, extra_context))
 
+@require_http_methods(["GET", "POST"])
 @login_required
 @signed_terms_required
 @transaction.commit_manually
@@ -217,6 +220,7 @@ def invite(request, template_name='im/invitations.html', extra_context={}):
                            invitation_form = form,
                            context_instance = context)
 
+@require_http_methods(["GET", "POST"])
 @login_required
 @signed_terms_required
 def edit_profile(request, template_name='im/profile.html', extra_context={}):
@@ -262,7 +266,7 @@ def edit_profile(request, template_name='im/profile.html', extra_context={}):
                 next = request.POST.get('next')
                 if next:
                     return redirect(next)
-                msg = _('Profile has been updated successfully')
+                msg = _('<p>Profile has been updated successfully</p>')
                 messages.add_message(request, messages.SUCCESS, msg)
             except ValueError, ve:
                 messages.add_message(request, messages.ERROR, ve)
@@ -275,6 +279,7 @@ def edit_profile(request, template_name='im/profile.html', extra_context={}):
                            context_instance = get_context(request,
                                                           extra_context))
 
+@require_http_methods(["GET", "POST"])
 def signup(request, template_name='im/signup.html', on_success='im/signup_complete.html', extra_context={}, backend=None):
     """
     Allows a user to create a local account.
@@ -355,6 +360,7 @@ def signup(request, template_name='im/signup.html', on_success='im/signup_comple
                            provider = provider,
                            context_instance=get_context(request, extra_context))
 
+@require_http_methods(["GET", "POST"])
 @login_required
 @signed_terms_required
 def feedback(request, template_name='im/feedback.html', email_template_name='im/feedback_mail.txt', extra_context={}):
@@ -407,15 +413,18 @@ def feedback(request, template_name='im/feedback.html', email_template_name='im/
                            feedback_form = form,
                            context_instance = get_context(request, extra_context))
 
+@require_http_methods(["GET", "POST"])
 def logout(request, template='registration/logged_out.html', extra_context={}):
     """
     Wraps `django.contrib.auth.logout` and delete the cookie.
     """
-    msg = 'Cookie deleted for %s' % (request.user.email)
-    auth_logout(request)
     response = HttpResponse()
-    response.delete_cookie(COOKIE_NAME, path='/', domain=COOKIE_DOMAIN)
-    logger._log(LOGGING_LEVEL, msg, [])
+    if request.user.is_authenticated():
+        email = request.user.email
+        auth_logout(request)
+        response.delete_cookie(COOKIE_NAME, path='/', domain=COOKIE_DOMAIN)
+        msg = 'Cookie deleted for %s' % email
+        logger._log(LOGGING_LEVEL, msg, [])
     next = request.GET.get('next')
     if next:
         response['Location'] = next
@@ -425,13 +434,14 @@ def logout(request, template='registration/logged_out.html', extra_context={}):
         response['Location'] = LOGOUT_NEXT
         response.status_code = 301
         return response
-    messages.add_message(request, messages.SUCCESS, _('You have successfully logged out.'))
+    messages.add_message(request, messages.SUCCESS, _('<p>You have successfully logged out.</p>'))
     context = get_context(request, extra_context)
     response.write(render_to_string(template, context_instance=context))
     return response
 
+@require_http_methods(["GET", "POST"])
 @transaction.commit_manually
-def activate(request, email_template_name='im/welcome_email.txt', helpdesk_email_template_name='im/helpdesk_notification.txt'):
+def activate(request, greeting_email_template_name='im/welcome_email.txt', helpdesk_email_template_name='im/helpdesk_notification.txt'):
     """
     Activates the user identified by the ``auth`` request parameter, sends a welcome email
     and renews the user token.
@@ -455,7 +465,7 @@ def activate(request, email_template_name='im/welcome_email.txt', helpdesk_email
         local_user = AstakosUser.objects.get(~Q(id = user.id), email=user.email, is_active=True)
     except AstakosUser.DoesNotExist:
         try:
-            activate_func(user, email_template_name, helpdesk_email_template_name, verify_email=True)
+            activate_func(user, greeting_email_template_name, helpdesk_email_template_name, verify_email=True)
             response = prepare_response(request, user, next, renew=True)
             transaction.commit()
             return response
@@ -473,7 +483,7 @@ def activate(request, email_template_name='im/welcome_email.txt', helpdesk_email
             return index(request)
     else:
         try:
-            user = switch_account_to_shibboleth(user, local_user, email_template_name)
+            user = switch_account_to_shibboleth(user, local_user, greeting_email_template_name)
             response = prepare_response(request, user, next, renew=True)
             transaction.commit()
             return response
@@ -490,6 +500,7 @@ def activate(request, email_template_name='im/welcome_email.txt', helpdesk_email
             transaction.rollback()
             return index(request)
 
+@require_http_methods(["GET", "POST"])
 def approval_terms(request, term_id=None, template_name='im/approval_terms.html', extra_context={}):
     term = None
     terms = None
@@ -530,10 +541,16 @@ def approval_terms(request, term_id=None, template_name='im/approval_terms.html'
                                approval_terms_form = form,
                                context_instance = get_context(request, extra_context))
 
+@require_http_methods(["GET", "POST"])
 @signed_terms_required
 def change_password(request):
-    return password_change(request, post_change_redirect=reverse('astakos.im.views.edit_profile'))
+    return password_change(request,
+                            post_change_redirect=reverse('astakos.im.views.edit_profile'),
+                            password_change_form=ExtendedPasswordChangeForm)
 
+@require_http_methods(["GET", "POST"])
+@login_required
+@signed_terms_required
 @transaction.commit_manually
 def change_email(request, activation_key=None,
                  email_template_name='registration/email_change_email.txt',
@@ -581,4 +598,4 @@ def change_email(request, activation_key=None,
     return render_response(form_template_name,
                            form = form,
                            context_instance = get_context(request,
-                                                          extra_context))
\ No newline at end of file
+                                                          extra_context))