Prevent changing of dates on already approved news and events

Since this can be used to bypass moderator approval and move items
to the frontpage of the site, they're blocked. We still allow the user
to make corrections in the text and other such fields.

diff --git a/pgweb/events/forms.py b/pgweb/events/forms.py
index 1e4dbfcdd36aac172e6b493899169eaf404587a5..1eaf02341f5ec1f6e530c73cbe071f15989039de 100644 (file)
--- a/pgweb/events/forms.py
+++ b/pgweb/events/forms.py
@@ -1,4 +1,5 @@
 from django import forms
+from django.forms import ValidationError
 
 from pgweb.core.models import Organisation
 from models import Event
@@ -28,6 +29,18 @@ class EventForm(forms.ModelForm):
                                del cleaned_data['country']
                return cleaned_data
 
+       def clean_startdate(self):
+               if self.instance.pk and self.instance.approved:
+                       if self.cleaned_data['startdate'] != self.instance.startdate:
+                               raise ValidationError("You cannot change the dates on events that have been approved")
+               return self.cleaned_data['startdate']
+
+       def clean_enddate(self):
+               if self.instance.pk and self.instance.approved:
+                       if self.cleaned_data['enddate'] != self.instance.enddate:
+                               raise ValidationError("You cannot change the dates on events that have been approved")
+               return self.cleaned_data['enddate']
+
        class Meta:
                model = Event
                exclude = ('submitter', 'approved', )

diff --git a/pgweb/news/forms.py b/pgweb/news/forms.py
index 39726d4a2993d373b4e87a9cb62381fd1d33b951..dd8f54c729a6f948b796f308f5e99f5c18f3bc8e 100644 (file)
--- a/pgweb/news/forms.py
+++ b/pgweb/news/forms.py
@@ -1,4 +1,5 @@
 from django import forms
+from django.forms import ValidationError
 
 from pgweb.core.models import Organisation
 from models import NewsArticle
@@ -8,6 +9,12 @@ class NewsArticleForm(forms.ModelForm):
                super(NewsArticleForm, self).__init__(*args, **kwargs)
        def filter_by_user(self, user):
                self.fields['org'].queryset = Organisation.objects.filter(managers=user, approved=True)
+       def clean_date(self):
+               if self.instance.pk and self.instance.approved:
+                       if self.cleaned_data['date'] != self.instance.date:
+                               raise ValidationError("You cannot change the date on an article that has been approved")
+               return self.cleaned_data['date']
+
        class Meta:
                model = NewsArticle
                exclude = ('submitter', 'approved', )