Merge branch 'master' of git://gitorious.org/mediagoblin/mediagoblin

[mediagoblin.git] / mediagoblin / user_pages / views.py

diff --git a/mediagoblin/user_pages/views.py b/mediagoblin/user_pages/views.py
index 2e6136977ecfd6193ca43bc3fdeee249aa284a88..e5646faaed807835cd1bbd08fb62ae6d28d1c7ec 100644 (file)
--- a/mediagoblin/user_pages/views.py
+++ b/mediagoblin/user_pages/views.py
@@ -199,6 +199,10 @@ def media_post_comment(request, media):
 
 def media_preview_comment(request):
     """Runs a comment through markdown so it can be previewed."""
+    # If this isn't an ajax request, render_404
+    if not request.is_xhr:
+        return render_404(request)
+
     comment = unicode(request.form['comment_content'])
     cleancomment = { "content":cleaned_markdown_conversion(comment)}
 
@@ -282,11 +286,29 @@ def media_collect(request, media):
 
 
 #TODO: Why does @user_may_delete_media not implicate @require_active_login?
-@get_media_entry_by_id
-@require_active_login
-@user_may_delete_media
-def media_confirm_delete(request, media):
 
+@require_active_login
+def media_confirm_delete(request):
+    
+    allowed_state = [u'failed', u'processed']
+    media = None
+    for media_state in allowed_state:
+        media = request.db.MediaEntry.query.filter_by(id=request.matchdict['media_id'], state=media_state).first()
+        if media:
+            break
+    
+    if not media:
+        return render_404(request)
+    
+    given_username = request.matchdict.get('user')
+    if given_username and (given_username != media.get_uploader.username):
+        return render_404(request)
+    
+    uploader_id = media.uploader
+    if not (request.user.is_admin or
+            request.user.id == uploader_id):
+        raise Forbidden()
+    
     form = user_forms.ConfirmDeleteForm(request.form)
 
     if request.method == 'POST' and form.validate():
@@ -297,8 +319,13 @@ def media_confirm_delete(request, media):
             messages.add_message(
                 request, messages.SUCCESS, _('You deleted the media.'))
 
-            return redirect(request, "mediagoblin.user_pages.user_home",
-                user=username)
+            location = media.url_to_next(request.urlgen)
+            if not location:
+                location=media.url_to_prev(request.urlgen)
+            if not location:
+                location=request.urlgen("mediagoblin.user_pages.user_home",
+                                        user=username)
+            return redirect(request, location=location)
         else:
             messages.add_message(
                 request, messages.ERROR,