added XSRF protection to all forms and associated tests

[bluechips.git] / bluechips / controllers / transfer.py

diff --git a/bluechips/controllers/transfer.py b/bluechips/controllers/transfer.py
index 79628ef3c18b0abb834e97ecbd12dd3ae377850e..ed0601845fc58b9db6f8ad67bfd1daf1e10d0702 100644 (file)
--- a/bluechips/controllers/transfer.py
+++ b/bluechips/controllers/transfer.py
@@ -4,13 +4,19 @@ Handle transfers
 
 import logging
 
+from datetime import date
+
 from bluechips.lib.base import *
 
-from pylons import request
+from pylons import request, app_globals as g
 from pylons.decorators import validate
+from pylons.decorators.secure import authenticate_form
+from pylons.controllers.util import abort
 
 from formencode import Schema, validators
 
+from mailer import Message
+
 log = logging.getLogger(__name__)
 
 
@@ -19,9 +25,9 @@ class TransferSchema(Schema):
     allow_extra_fields = False
     debtor_id = validators.Int(not_empty=True)
     creditor_id = validators.Int(not_empty=True)
-    amount = validators.Number(not_empty=True)
+    amount = model.types.CurrencyValidator(not_empty=True)
     description = validators.UnicodeString()
-    date = validators.String()
+    date = validators.DateConverter()
  
 
 class TransferController(BaseController):
@@ -34,23 +40,38 @@ class TransferController(BaseController):
             c.title = 'Add a New Transfer'
             c.transfer = model.Transfer()
             c.transfer.debtor_id = request.environ['user'].id
+            c.transfer.date = date.today()
         else:
             c.title = 'Edit a Transfer'
             c.transfer = meta.Session.query(model.Transfer).get(id)
+            if c.transfer is None:
+                abort(404)
         return render('/transfer/index.mako')
     
+    @redirect_on_get('edit')
+    @authenticate_form
     @validate(schema=TransferSchema(), form='edit')
     def update(self, id=None):
         if id is None:
             t = model.Transfer()
             meta.Session.add(t)
+            op = 'created'
         else:
             t = meta.Session.query(model.Transfer).get(id)
+            if t is None:
+                abort(404)
+            op = 'updated'
         
-        t.amount = self.form_result.pop('amount') * 100
         update_sar(t, self.form_result)
         meta.Session.commit()
-        
-        h.flash('Transfer updated.')
-        
+       
+        show = ('Transfer of %s from %s to %s %s.' %
+                (t.amount, t.debtor, t.creditor, op))
+        h.flash(show)
+
+        # Send email notification to involved users if they have an email set.
+        body = render('/emails/transfer.txt', extra_vars={'transfer': t,
+                                                          'op': op})
+        g.handle_notification((t.debtor, t.creditor), show, body)
+
         return h.redirect_to('/')