We're sorry, but you are not authorized to view this page.
+
+{% endblock %}
\ No newline at end of file
diff --git a/map/views.py b/map/views.py
index 46c1283..47552b4 100644
--- a/map/views.py
+++ b/map/views.py
@@ -1,4 +1,5 @@
from django.shortcuts import render, get_object_or_404
+from middleware.http import Http403
from models import Place, Asset, Sensor, SensorStatus
from django.conf import settings
from event_manager.models import Event, Alarm
@@ -14,14 +15,15 @@ def my_places(request):
def place_view(request, pk):
server_path = "%s://%s%s" % (request.META['wsgi.url_scheme'], request.META['HTTP_HOST'], settings.STATIC_URL)
- # TODO: Check if the current user has permission to view this place
-
show_icons_script = \
'function showIcons(jQuery) { \
var c = document.getElementById("place_canvas"); \
var ctx = c.getContext("2d");'
place = get_object_or_404(Place, pk=pk)
+ if request.user != place.owner:
+ raise Http403
+
# Get all assets in the current place
assets = Asset.objects.filter(place=place)
for asset in assets:
@@ -29,15 +31,15 @@ def place_view(request, pk):
for sensor in sensors:
# Get the sensor status based on current_status_id saved by event_manager previously
try:
- status = SensorStatus.objects.get(id=sensor.current_status_id)
- #filename, file_ext = splitext(basename(str(status.icon)))
- show_icons_script = \
- '%s var sensor_icon%s = new Image();' \
- 'sensor_icon%s.src = "%s"; \
- ctx.drawImage(sensor_icon%s, %s, %s);' \
- % (show_icons_script, sensor.id,
- sensor.id, status.icon, #server_path, filename, file_ext,
- sensor.id, sensor.current_pos_x, sensor.current_pos_y)
+ status = sensor.type.sensorstatus_set.filter(ref_code=sensor.current_status_id)[:1].get()
+ if status:
+ show_icons_script = \
+ '%s var sensor_icon%s = new Image();' \
+ 'sensor_icon%s.src = "%s"; \
+ ctx.drawImage(sensor_icon%s, %s, %s);' \
+ % (show_icons_script, sensor.id,
+ sensor.id, status.icon,
+ sensor.id, sensor.current_pos_x, sensor.current_pos_y)
except SensorStatus.DoesNotExist:
pass
@@ -51,8 +53,8 @@ def place_view(request, pk):
settings.MAP_FILE_PATH[4:len(settings.MAP_FILE_PATH)],
filename, file_ext)'''
- alarms = Alarm.objects.filter(event__sensor__asset__place__owner=request.user).order_by('-activation_date')
- events = Event.objects.filter(sensor__asset__place__owner=request.user).order_by('-timestamp')
+ alarms = Alarm.objects.filter(event__sensor__asset__place=place).order_by('-activation_date')
+ events = Event.objects.filter(sensor__asset__place=place).order_by('-timestamp')
context = {'place': place, 'show_icons_script': show_icons_script,
'map_url': place.map, 'events': events, 'alarms': alarms}
diff --git a/middleware/__init__.py b/middleware/__init__.py
new file mode 100644
index 0000000..e69de29
diff --git a/middleware/http.py b/middleware/http.py
new file mode 100644
index 0000000..fbe8757
--- /dev/null
+++ b/middleware/http.py
@@ -0,0 +1,51 @@
+from django.conf import settings
+from django.http import HttpResponseForbidden
+from django.template import RequestContext,Template,loader,TemplateDoesNotExist
+from django.utils.importlib import import_module
+
+"""
+# Middleware to allow the display of a 403.html template when a
+# 403 error is raised.
+"""
+
+class Http403(Exception):
+ pass
+
+class Http403Middleware(object):
+ def process_exception(self, request, exception):
+ from http import Http403
+
+ if not isinstance(exception, Http403):
+ # Return None so django doesn't re-raise the exception
+ return None
+
+ try:
+ # Handle import error but allow any type error from view
+ callback = getattr(import_module(settings.ROOT_URLCONF),'handler403')
+ return callback(request,exception)
+ except (ImportError,AttributeError):
+ # Try to get a 403 template
+ try:
+ # First look for a user-defined template named "403.html"
+ t = loader.get_template('403.html')
+ except TemplateDoesNotExist:
+ # If a template doesn't exist in the projct, use the following hardcoded template
+ t = Template("""{% load i18n %}
+
+
+
+ {% trans "403 ERROR: Access denied" %}
+
+
+
{% trans "Access Denied (403)" %}
+ {% trans "We're sorry, but you are not authorized to view this page." %}
+
+ """)
+
+ # Now use context and render template
+ c = RequestContext(request, {
+ 'message': exception.message
+ })
+
+ return HttpResponseForbidden(t.render(c))
\ No newline at end of file