From b56cd89eb8cad5f2b4ac50d6c2cdba9ef3b90081 Mon Sep 17 00:00:00 2001 From: ayleph Date: Sat, 16 Aug 2014 10:45:58 -0700 Subject: [PATCH] List blogs by URL user rather than request user The blog_post_listing function in mediagoblin/media_types/blow/views.py attempts to access blogs based on the requesting user rather than the url user. This results in server errors when an unauthenticated user attempts to follow a link from another user's blog post listing, and 404 errors when an authenticated user attempts to follow a link from another user's blog post listing. This change bases blog post listings on the URL user rather than the request user. --- mediagoblin/media_types/blog/views.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mediagoblin/media_types/blog/views.py b/mediagoblin/media_types/blog/views.py index a367bef8..62806c3c 100644 --- a/mediagoblin/media_types/blog/views.py +++ b/mediagoblin/media_types/blog/views.py @@ -260,7 +260,7 @@ def blog_post_listing(request, page, url_user=None): Page, listing all the blog posts of a particular blog. """ blog_slug = request.matchdict.get('blog_slug', None) - blog = get_blog_by_slug(request, blog_slug, author=request.user.id) + blog = get_blog_by_slug(request, blog_slug, author=url_user.id) if not blog: return render_404(request) -- 2.25.1