]> asedeno.scripts.mit.edu Git - bluechips.git/blob - bluechips/controllers/transfer.py
added XSRF protection to all forms and associated tests
[bluechips.git] / bluechips / controllers / transfer.py
1 """
2 Handle transfers
3 """
4
5 import logging
6
7 from datetime import date
8
9 from bluechips.lib.base import *
10
11 from pylons import request, app_globals as g
12 from pylons.decorators import validate
13 from pylons.decorators.secure import authenticate_form
14 from pylons.controllers.util import abort
15
16 from formencode import Schema, validators
17
18 from mailer import Message
19
20 log = logging.getLogger(__name__)
21
22
23 class TransferSchema(Schema):
24     "Validate a transfer."
25     allow_extra_fields = False
26     debtor_id = validators.Int(not_empty=True)
27     creditor_id = validators.Int(not_empty=True)
28     amount = model.types.CurrencyValidator(not_empty=True)
29     description = validators.UnicodeString()
30     date = validators.DateConverter()
31  
32
33 class TransferController(BaseController):
34     def index(self):
35        return self.edit()
36     
37     def edit(self, id=None):
38         c.users = meta.Session.query(model.User.id, model.User.name)
39         if id is None:
40             c.title = 'Add a New Transfer'
41             c.transfer = model.Transfer()
42             c.transfer.debtor_id = request.environ['user'].id
43             c.transfer.date = date.today()
44         else:
45             c.title = 'Edit a Transfer'
46             c.transfer = meta.Session.query(model.Transfer).get(id)
47             if c.transfer is None:
48                 abort(404)
49         return render('/transfer/index.mako')
50     
51     @redirect_on_get('edit')
52     @authenticate_form
53     @validate(schema=TransferSchema(), form='edit')
54     def update(self, id=None):
55         if id is None:
56             t = model.Transfer()
57             meta.Session.add(t)
58             op = 'created'
59         else:
60             t = meta.Session.query(model.Transfer).get(id)
61             if t is None:
62                 abort(404)
63             op = 'updated'
64         
65         update_sar(t, self.form_result)
66         meta.Session.commit()
67        
68         show = ('Transfer of %s from %s to %s %s.' %
69                 (t.amount, t.debtor, t.creditor, op))
70         h.flash(show)
71
72         # Send email notification to involved users if they have an email set.
73         body = render('/emails/transfer.txt', extra_vars={'transfer': t,
74                                                           'op': op})
75         g.handle_notification((t.debtor, t.creditor), show, body)
76
77         return h.redirect_to('/')