use honeypot only for contact forms (not for api)

[edumed.git] / contact / views.py

diff --git a/contact/views.py b/contact/views.py
index 823c046..b9a411f 100644 (file)
--- a/contact/views.py
+++ b/contact/views.py
@@ -1,12 +1,17 @@
 # -*- coding: utf-8 -*-
+from urllib import unquote
+
 from django.contrib.auth.decorators import permission_required
 from django.http import Http404
 from django.shortcuts import get_object_or_404, redirect, render
 from fnpdjango.utils.views import serve_file
+from honeypot.decorators import check_honeypot
+
 from .forms import contact_forms
 from .models import Attachment
 
 
+@check_honeypot
 def form(request, form_tag, force_enabled=False):
     try:
         form_class = contact_forms[form_tag]
@@ -16,7 +21,7 @@ def form(request, form_tag, force_enabled=False):
             not (force_enabled and request.user.is_superuser)):
         template = getattr(form_class, 'disabled_template', None)
         if template:
-            return render(request, template)
+            return render(request, template, {'title': form_class.form_title})
         raise Http404
     if request.method == 'POST':
         form = form_class(request.POST, request.FILES)
@@ -55,4 +60,5 @@ def thanks(request, form_tag):
 @permission_required('contact.change_attachment')
 def attachment(request, contact_id, tag):
     attachment = get_object_or_404(Attachment, contact_id=contact_id, tag=tag)
-    return serve_file(attachment.file.url)
+    attachment_url = unquote(attachment.file.url)
+    return serve_file(attachment_url)