From e14c0e58e4e52c1984703c7be18d3ccf3bfc6f49 Mon Sep 17 00:00:00 2001
From: Shraddha Agrawal <shraddha.agrawal000@gmail.com>
Date: May 22 2019 11:33:00 +0000
Subject: Add access to message confirmation link only to sender


This commit adds the following functionality:
1. User needs to be logged in to access confirmation link.
2. Only the sender of the message can successfully confirm it.
3. A alert message is displayed when a user that isn't identified
as the sender of the message accesses the confirmation link.

---

diff --git a/happinesspackets/messaging/views.py b/happinesspackets/messaging/views.py
index 0899711..0c1352b 100644
--- a/happinesspackets/messaging/views.py
+++ b/happinesspackets/messaging/views.py
@@ -143,7 +143,7 @@ class MessageSenderConfirmationSentView(TemplateView):
     template_name = 'messaging/message_sender_confirmation_sent.html'
 
 
-class MessageSenderConfirmationView(TemplateView):
+class MessageSenderConfirmationView(LoginRequiredMixin,TemplateView):
     template_name = 'messaging/message_sender_confirmation_failed.html'
 
     def get(self, request, *args, **kwargs):
@@ -152,6 +152,8 @@ class MessageSenderConfirmationView(TemplateView):
         except Message.DoesNotExist:
             return render(request, self.template_name, {'not_found': True})
 
+        if message.sender_email != self.request.user.email:
+            return render(request, self.template_name, {'not_sender': True})
         if message.status != Message.STATUS.pending_sender_confirmation:
             return render(request, self.template_name, {'already_confirmed': True})
 
diff --git a/templates/messaging/message_sender_confirmation_failed.html b/templates/messaging/message_sender_confirmation_failed.html
index 2f9ed7b..ba74317 100644
--- a/templates/messaging/message_sender_confirmation_failed.html
+++ b/templates/messaging/message_sender_confirmation_failed.html
@@ -10,6 +10,10 @@
         <div class="alert alert-danger">
             We couldn't find this message. Make sure that the URL is complete.
         </div>
+    {% elif not_sender %}
+        <div class="alert alert-danger">
+            The message can't be confirmed since you aren't the sender of the message.
+        </div>
     {% elif already_confirmed %}
         <div class="alert alert-info">
             You already confirmed this message.