Prevented one form of DoS attack by limiting number of tags in query to 6.
[wolnelektury.git] / apps / catalogue / views.py
1 # -*- coding: utf-8 -*-
2 from django.template import RequestContext
3 from django.shortcuts import render_to_response, get_object_or_404
4 from django.http import HttpResponse, HttpResponseRedirect, Http404
5 from django.core.urlresolvers import reverse
6 from django.db.models import Q
7 from django.contrib.auth.decorators import login_required
8 from django.utils.datastructures import SortedDict
9 from django.views.decorators.http import require_POST
10 from django.contrib import auth
11 from django.contrib.auth.forms import UserCreationForm, AuthenticationForm
12 from django.utils import simplejson
13 from django.utils.functional import Promise
14 from django.utils.encoding import force_unicode
15
16 from catalogue import models
17 from catalogue import forms
18 from catalogue.utils import split_tags
19 from newtagging import views as newtagging_views
20
21
22 class LazyEncoder(simplejson.JSONEncoder):
23     def default(self, obj):
24         if isinstance(obj, Promise):
25             return force_unicode(obj)
26         return obj
27
28
29 def search(request):
30     query = request.GET.get('q', '')
31     tags = request.GET.get('tags', '')
32     if tags == '':
33         tags = []
34     
35     try:
36         tag_list = models.Tag.get_tag_list(tags)
37         tag = models.Tag.objects.get(name=query)
38     except models.Tag.DoesNotExist:
39         try:
40             book = models.Book.objects.get(title=query)
41             return HttpResponseRedirect(book.get_absolute_url())
42         except models.Book.DoesNotExist:
43             return HttpResponseRedirect(reverse('catalogue.views.main_page'))
44     else:
45         tag_list.append(tag)
46         return HttpResponseRedirect(reverse('catalogue.views.tagged_object_list', 
47             kwargs={'tags': '/'.join(tag.slug for tag in tag_list)}
48         ))
49
50
51 def tags_starting_with(request):
52     try:
53         prefix = request.GET['q']
54         if len(prefix) < 2:
55             raise KeyError
56             
57         books = models.Book.objects.filter(title__icontains=prefix)
58         tags = models.Tag.objects.filter(name__icontains=prefix)
59         if request.user.is_authenticated():
60             tags = tags.filter(~Q(category='set') | Q(user=request.user))
61         else:
62             tags = tags.filter(~Q(category='set'))
63         
64         completions = [book.title for book in books] + [tag.name for tag in tags]
65
66         return HttpResponse('\n'.join(completions))    
67     
68     except KeyError:
69         return HttpResponse('')
70
71
72 def main_page(request):    
73     if request.user.is_authenticated():
74         shelves = models.Tag.objects.filter(category='set', user=request.user)
75         new_set_form = forms.NewSetForm()
76     extra_where = 'NOT catalogue_tag.category = "set"'
77     tags = models.Tag.objects.usage_for_model(models.Book, counts=True, extra={'where': [extra_where]})
78     fragment_tags = models.Tag.objects.usage_for_model(models.Fragment, counts=True,
79         extra={'where': ['catalogue_tag.category = "theme"'] + [extra_where]})
80     categories = split_tags(tags)
81     
82     form = forms.SearchForm()
83     return render_to_response('catalogue/main_page.html', locals(),
84         context_instance=RequestContext(request))
85
86
87 def book_list(request):
88     books = models.Book.objects.all()
89     form = forms.SearchForm()
90     
91     books_by_first_letter = SortedDict()
92     for book in books:
93         books_by_first_letter.setdefault(book.title[0], []).append(book)
94     
95     return render_to_response('catalogue/book_list.html', locals(),
96         context_instance=RequestContext(request))
97
98
99 def tagged_object_list(request, tags=''):
100     # Prevent DoS attacks on our database
101     if len(tags.split('/')) > 6:
102         raise Http404
103         
104     try:
105         tags = models.Tag.get_tag_list(tags)
106     except models.Tag.DoesNotExist:
107         raise Http404
108     
109     model = models.Book
110     shelf_is_set = (len(tags) == 1 and tags[0].category == 'set')
111     theme_is_set = any(tag.category == 'theme' for tag in tags)
112     if theme_is_set:
113         model = models.Fragment
114
115     extra_where = 'NOT catalogue_tag.category = "set"'
116     related_tags = models.Tag.objects.related_for_model(tags, model, counts=True, extra={'where': [extra_where]})
117     categories = split_tags(related_tags)
118
119     return newtagging_views.tagged_object_list(
120         request,
121         tag_model=models.Tag,
122         queryset_or_model=model,
123         tags=tags,
124         template_name='catalogue/tagged_object_list.html',
125         extra_context = {'categories': categories, 'shelf_is_set': shelf_is_set },
126     )
127
128
129 def book_detail(request, slug):
130     book = get_object_or_404(models.Book, slug=slug)
131     tags = list(book.tags.filter(~Q(category='set')))
132     categories = split_tags(tags)
133     
134     form = forms.SearchForm()
135     return render_to_response('catalogue/book_detail.html', locals(),
136         context_instance=RequestContext(request))
137
138
139 def logout_then_redirect(request):
140     auth.logout(request)
141     return HttpResponseRedirect(request.GET.get('next', '/'))
142
143
144 @require_POST
145 def register(request):
146     registration_form = UserCreationForm(request.POST, prefix='registration')
147     if registration_form.is_valid():
148         user = registration_form.save()
149         user = auth.authenticate(
150             username=registration_form.cleaned_data['username'], 
151             password=registration_form.cleaned_data['password1']
152         )
153         auth.login(request, user)
154         response_data = {'success': True, 'errors': {}}
155     else:
156         response_data = {'success': False, 'errors': registration_form.errors}
157     return HttpResponse(LazyEncoder(ensure_ascii=False).encode(response_data))
158
159
160 @require_POST
161 def login(request):
162     form = AuthenticationForm(data=request.POST, prefix='login')
163     if form.is_valid():
164         auth.login(request, form.get_user())
165         response_data = {'success': True, 'errors': {}}
166     else:
167         response_data = {'success': False, 'errors': form.errors}
168     return HttpResponse(LazyEncoder(ensure_ascii=False).encode(response_data))
169
170
171 def book_sets(request, slug):
172     book = get_object_or_404(models.Book, slug=slug)
173     user_sets = models.Tag.objects.filter(category='set', user=request.user)
174     book_sets = book.tags.filter(category='set', user=request.user)
175     
176     if not request.user.is_authenticated():
177         return HttpResponse('<p>Aby zarządzać swoimi półkami, musisz się zalogować.</p>')
178     
179     if request.method == 'POST':
180         form = forms.ObjectSetsForm(book, request.user, request.POST)
181         if form.is_valid():
182             book.tags = ([models.Tag.objects.get(pk=id) for id in form.cleaned_data['set_ids']] +
183                 list(book.tags.filter(~Q(category='set') | ~Q(user=request.user))))
184             if request.is_ajax():
185                 return HttpResponse('<p>Półki zostały zapisane.</p>')
186             else:
187                 return HttpResponseRedirect('/')
188     else:
189         form = forms.ObjectSetsForm(book, request.user)
190         new_set_form = forms.NewSetForm()
191     
192     return render_to_response('catalogue/book_sets.html', locals(),
193         context_instance=RequestContext(request))
194
195
196 def fragment_sets(request, id):
197     fragment = get_object_or_404(models.Fragment, pk=id)
198     user_sets = models.Tag.objects.filter(category='set', user=request.user)
199     fragment_sets = fragment.tags.filter(category='set', user=request.user)
200
201     if not request.user.is_authenticated():
202         return HttpResponse('<p>Aby zarządzać swoimi półkami, musisz się zalogować.</p>')
203
204     if request.method == 'POST':
205         form = forms.ObjectSetsForm(fragment, request.user, request.POST)
206         if form.is_valid():
207             fragment.tags = ([models.Tag.objects.get(pk=id) for id in form.cleaned_data['set_ids']] +
208                 list(fragment.tags.filter(~Q(category='set') | ~Q(user=request.user))))
209             if request.is_ajax():
210                 return HttpResponse('<p>Półki zostały zapisane.</p>')
211             else:
212                 return HttpResponseRedirect('/')
213     else:
214         form = forms.ObjectSetsForm(fragment, request.user)
215         new_set_form = forms.NewSetForm()
216
217     return render_to_response('catalogue/fragment_sets.html', locals(),
218         context_instance=RequestContext(request))
219
220
221 @login_required
222 @require_POST
223 def new_set(request):
224     new_set_form = forms.NewSetForm(request.POST)
225     if new_set_form.is_valid():
226         new_set = new_set_form.save(request.user)
227         
228         if request.is_ajax():
229             return HttpResponse(u'<p>Półka <strong>%s</strong> została utworzona</p>' % new_set)
230         else:
231             return HttpResponseRedirect('/')
232     
233     return render_to_response('catalogue/book_sets.html', locals(),
234             context_instance=RequestContext(request))
235
236
237 @login_required
238 @require_POST
239 def delete_shelf(request, slug):
240     user_set = get_object_or_404(models.Tag, slug=slug, category='set', user=request.user)
241     user_set.delete()
242     
243     if request.is_ajax():
244         return HttpResponse(u'<p>Półka <strong>%s</strong> została usunięta</p>' % user_set.name)
245     else:
246         return HttpResponseRedirect('/')
247
248
249 @login_required
250 def user_shelves(request):
251     shelves = models.Tag.objects.filter(category='set', user=request.user)
252     new_set_form = forms.NewSetForm()
253     return render_to_response('catalogue/user_shelves.html', locals(),
254             context_instance=RequestContext(request))
255