def dispatch(self, request, *args, **kwargs):
self.request = request
""" Check if the user can access the targeted user profile. """
target_user_profile = self.get_object(self.get_queryset())
if not target_user_profile:
return redirect_to_not_logged_in(request)
target_user_visibility = target_user_profile.media_tag.visibility
user = request.user
# VISIBILITY_ALL users can always be seen, so skip the check
if not target_user_visibility == BaseTagObject.VISIBILITY_ALL:
# all other views require at least to be logged in
if not user.is_authenticated:
return redirect_to_not_logged_in(request)
if not check_user_can_see_user(user, target_user_profile.user):
raise PermissionDenied
return super(UserProfileDetailView,
self).dispatch(request, *args, **kwargs)
def get_initial(self):
initial = super(WriteView, self).get_initial()
if self.request.method == 'GET':
initial.update(list(self.request.GET.items())
) # allow optional initializations by query string
recipients = []
user_recipients = self.kwargs.get('recipients')
if user_recipients:
# order_by() is not mandatory, but: a) it doesn't hurt; b) it eases the test suite
# and anyway the original ordering cannot be respected.
user_model = get_user_model()
name_user_as = getattr(settings, 'POSTMAN_NAME_USER_AS',
user_model.USERNAME_FIELD)
users = user_model.objects.filter(
is_active=True,
**{
'{0}__in'.format(name_user_as): [
r.strip() for r in user_recipients.split(',')
if r and not r.isspace()
]
}).order_by(name_user_as)
usernames = [
'user:%s' % getattr(user, name_user_as) for user in users
if check_user_can_see_user(self.request.user, user)
and not user.id == self.request.user.id
]
if usernames:
recipients.extend(usernames)
group_recipients = self.kwargs.get('group_recipients')
if group_recipients:
groups = [
'group:%s' % group_slug
for group_slug in group_recipients.split(',')
]
if groups:
recipients.extend(groups)
initial['recipients'] = ', '.join(recipients)
return initial
def user_write_permission_filter(sender, recipient, recipients_list):
""" Make sure the users can interact with each other """
if check_user_can_see_user(sender, recipient):
return None
return 'This user is private and you are not in any groups/projects with them!'