rug-website/rugwebsite/views.py

109 lines
4.2 KiB
Python
Raw Normal View History

2018-05-04 16:34:35 +02:00
import json
import hashlib
2018-05-04 15:09:27 +02:00
from django.contrib.auth.decorators import login_required
from django.contrib.auth.models import User
2017-11-14 09:51:57 +01:00
from django.shortcuts import render
2018-05-04 16:34:35 +02:00
from rugwebsite.forms import RequestGDPRDelete, GDPRAgreeCreate
2018-05-04 15:09:27 +02:00
from rugwebsite.models import PendingGDPRAgree, GDPRAgreed, PendingGDPRDelete
from django.utils.crypto import get_random_string
2017-11-14 09:51:57 +01:00
def home(request):
2018-05-04 15:09:27 +02:00
return render(request, 'rugwebsite/home.html', {'shownav': True})
def gdpr(request):
return render(request, 'rugwebsite/gdpr.html', {'show_agree_button': False, 'shownav': True})
@login_required
def gdpr_ask_agreement(request):
if not request.user.is_superuser:
raise PermissionError()
2018-05-04 15:20:39 +02:00
for user in User.objects.filter(username__in=('p207263', 'p233780', 'p253591', 'p269380'),
is_active=True).all():
2018-05-04 15:09:27 +02:00
token = get_random_string(length=32)
pending = PendingGDPRAgree(user=user, token=token)
pending.save()
pending.email()
return render(request, 'rugwebsite/gdpr.html', {'show_agree_button': False, 'shownav': True})
2018-05-04 16:34:35 +02:00
@login_required
def gdpr_create_agree(request):
if request.method == 'POST':
form = GDPRAgreeCreate(request.POST)
assert form.is_valid()
data = form.cleaned_data['data']
sha256 = hashlib.sha256()
sha256.update(data.encode('utf-8'))
2018-05-04 16:48:19 +02:00
assert request.session.get('samlPersoonsgegevensHash', None) == sha256.hexdigest(), "Persoonsgegevens have been tinkered with"
request.user = User()
2018-05-04 16:34:35 +02:00
request.user.username, request.user.first_name, request.user.last_name, request.user.email = json.loads(data)
2018-05-04 16:48:19 +02:00
request.user.is_active = True
request.user.save()
2018-05-04 16:34:35 +02:00
return render(request, 'rugwebsite/gdpr_agree_success.html', {'shownav': True})
else:
data = json.dumps([request.user.username, request.user.first_name, request.user.last_name, request.user.email])
sha256 = hashlib.sha256()
2018-05-04 16:48:19 +02:00
request.session['samlPersoonsgegevensHash'] = sha256.hexdigest()
request.user.delete()
2018-05-04 16:34:35 +02:00
2018-05-04 16:48:19 +02:00
form = GDPRAgreeCreate(defaults={'data': data})
return render(request, 'rugwebsite/gdpr.html', {'created': True, 'shownav': True, 'form': form})
2018-05-04 16:34:35 +02:00
2018-05-04 15:09:27 +02:00
def gdpr_request_delete(request):
if request.method == 'POST':
form = RequestGDPRDelete(request.POST)
if form.is_valid():
users = list(User.objects.filter(email=form.cleaned_data['email']).all())
for user in users:
token = get_random_string(length=32)
pending = PendingGDPRDelete(user=user, token=token)
pending.save()
pending.email()
return render(request, 'rugwebsite/gdpr_request_delete_successful.html', {'shownav': True, 'found': len(users) > 0})
else:
form = RequestGDPRDelete()
return render(request, 'rugwebsite/gdpr_request_delete.html', {'form': form, 'shownav': True})
def gdpr_delete(request, email, token):
pending = list(PendingGDPRDelete.objects.filter(user__email=email, token=token).all())
if len(pending) > 0:
for pending in pending:
pending.forget(request)
return render(request, 'rugwebsite/gdpr_delete.html', {'deleted': True, 'shownav': True})
return render(request, 'rugwebsite/gdpr_delete.html', {'deleted': False, 'shownav': True})
def gdpr_agree(request, email, token):
if 'agree' not in request.GET:
return render(request, 'rugwebsite/gdpr.html', {'show_agree_button': True, 'shownav': True, 'email': email,
'token': token})
2017-11-14 09:51:57 +01:00
2018-05-04 15:09:27 +02:00
result = {
'already_agreed': GDPRAgreed.objects.filter(user__email=email).exists(),
'show_agree_buttom': False,
'shownav': True
}
2017-11-14 09:51:57 +01:00
2018-05-04 15:09:27 +02:00
if not result['already_agreed']:
pending = list(PendingGDPRAgree.objects.filter(token=token, user__email=email).all())
if len(pending) == 1:
pending[0].agree()
else:
if GDPRAgreed.objects.filter(user__email=email).exists():
result['already_agreed'] = True
else:
result['token_not_found'] = True
2017-11-14 09:51:57 +01:00
2018-05-04 16:34:35 +02:00
return render(request, 'rugwebsite/gdpr_agree_success.html', result)