fix check_permissions decorator to handle not authenticated users

 - Legacy-Id: 8641

Author: rpcross

ietf/secr/proceedings/views.py

@@ -8,7 +8,6 @@
 
 from django.conf import settings
 from django.contrib import messages
-from django.contrib.auth.decorators import login_required
 from django.core.exceptions import ObjectDoesNotExist
 from django.core.urlresolvers import reverse
 from django.db.models import Max
@@ -331,7 +330,6 @@ def build(request,meeting_num,acronym):
     url = reverse('proceedings_upload_unified', kwargs={'meeting_num':meeting_num,'acronym':acronym})
     return HttpResponseRedirect(url)
 
-@login_required
 @check_permissions
 def delete_material(request,slide_id):
     '''
@@ -396,7 +394,6 @@ def delete_interim_meeting(request, meeting_num):
     url = reverse('proceedings_interim', kwargs={'acronym':group.acronym})
     return HttpResponseRedirect(url)
 
-@login_required
 @check_permissions
 def edit_slide(request, slide_id):
     '''
@@ -531,7 +528,6 @@ def main(request):
         RequestContext(request,{}),
     )
 
-@login_required
 @check_permissions
 def move_slide(request, slide_id, direction):
     '''
@@ -674,7 +670,6 @@ def recording_edit(request, meeting_num, name):
         RequestContext(request, {}),
     )
 
-@login_required
 @check_permissions
 def replace_slide(request, slide_id):
     '''
@@ -853,7 +848,6 @@ def select_interim(request):
         RequestContext(request,{}),
     )
 
-@login_required
 @check_permissions
 def upload_unified(request, meeting_num, acronym=None, session_id=None):
     '''

ietf/secr/sreq/views.py

@@ -1,7 +1,6 @@
 import datetime
 
 from django.contrib import messages
-from django.contrib.auth.decorators import login_required
 from django.db.models import Q
 from django.http import Http404
 from django.shortcuts import render_to_response, get_object_or_404, redirect
@@ -164,7 +163,6 @@ def session_conflicts_as_string(group, meeting):
 # -------------------------------------------------
 # View Functions
 # -------------------------------------------------
-@login_required
 @check_permissions
 def approve(request, acronym):
     '''
@@ -185,7 +183,6 @@ def approve(request, acronym):
         messages.error(request, 'Not authorized to approve the third session')
         return redirect('sessions_view', acronym=acronym)
 
-@login_required
 @check_permissions
 def cancel(request, acronym):
     '''
@@ -331,7 +328,6 @@ def session_save(session):
         # send an email to iesg-secretariat to alert to change
         pass
 
-@login_required
 @check_permissions
 def edit_mtg(request, num, acronym):
     '''
@@ -534,7 +530,6 @@ def main(request):
         RequestContext(request, {}),
     )
 
-@login_required
 @check_permissions
 def new(request, acronym):
     '''
@@ -596,7 +591,6 @@ def new(request, acronym):
         RequestContext(request, {}),
     )
 
-@login_required
 @check_permissions
 def no_session(request, acronym):
     '''

ietf/secr/utils/decorators.py

@@ -1,15 +1,17 @@
 from functools import wraps
 
-from django.http import HttpResponseRedirect
+from django.conf import settings
+from django.contrib.auth import REDIRECT_FIELD_NAME
+from django.http import HttpResponseRedirect, HttpResponseForbidden
 from django.shortcuts import render_to_response, get_object_or_404
+from django.utils.http import urlquote
 
 from ietf.ietfauth.utils import has_role
 from ietf.doc.models import Document
 from ietf.group.models import Group, Role
 from ietf.meeting.models import Session
 from ietf.secr.utils.meeting import get_timeslot
 
-
 def clear_non_auth(session):
     """
     Clears non authentication related keys from the session object
@@ -35,7 +37,7 @@ def inner(request, *args, **kwargs):
 
 def check_permissions(func):
     """
-    This decorator checks that the user making the request has access to the
+    View decorator for checking that the user is logged in and has access to the
     object being requested.  Expects one of the following four keyword
     arguments:
 
@@ -44,6 +46,9 @@ def check_permissions(func):
     meeting_id, slide_id
     """
     def wrapper(request, *args, **kwargs):
+        if not request.user.is_authenticated():
+            return HttpResponseRedirect('%s?%s=%s' % (settings.LOGIN_URL, REDIRECT_FIELD_NAME, urlquote(request.get_full_path())))
+        
         session = None
         # short circuit.  secretariat user has full access
         if has_role(request.user,'Secretariat'):
@@ -74,10 +79,8 @@ def wrapper(request, *args, **kwargs):
                 return func(request, *args, **kwargs)
 
         # if we get here access is denied
-        return render_to_response('unauthorized.html',{
-            'user_name':login,
-            'group_name':group.acronym}
-        )
+        return HttpResponseForbidden("User not authorized to access group: %s" % group.acronym)
+        
     return wraps(func)(wrapper)
 
 def sec_only(func):