Fixed work create and some security issues

app/library/views/__init__.py

@@ -161,7 +161,7 @@ class WorkListView(CollectionMixin, ListView):
 
     def get_works(self):
         collections = CollectionMixin.get_queryset(self)
-        return  Work.objects.filter(collection__in=collections).order_by('name').distinct().select_related('collection')
+        return  Work.objects.filter(collection__in=collections).select_related('collection')
         
     def get_context_data(self, *args, **kwargs):
         data = super(WorkListView, self).get_context_data(*args, **kwargs)
@@ -180,15 +180,16 @@ class WorkListView(CollectionMixin, ListView):
             else:
                 works = works.filter(Q(name__contains=q) | Q(composer__contains=q) | Q(meta_info__value__contains=q))
         
-        return works.order_by('name', 'pk')
+        return works.order_by('name', 'composer', 'edition', 'pk')
 
 class CollectionWorkListView(WorkListView):
 
     def get_works(self):
-        works = Work.objects.filter(collection=self.kwargs['collection']).distinct()
+        works = Work.objects.filter(collection=self.kwargs['collection'])
 
-        loan_count = Count('project_items', Q(project_items__checkout__lte=now(), project_items__returned=None))
-        works = works.annotate(loan_count=loan_count)
+        if self.request.is_admin:
+            loan_count = Count('project_items', Q(project_items__checkout__lte=now(), project_items__returned=None))
+            works = works.annotate(loan_count=loan_count)
         return works
 
     def get_context_data(self, *args, **kwargs):
@@ -202,6 +203,12 @@ class WorkAddView(CollectionMixin, FormView):
 
     title = "Add a new work"
 
+    def get_form(self, form_class=None):
+        form = super().get_form(form_class)
+        qs = models.Orchestration.objects.filter(Q(collection=None) | Q(collection=self.collection))
+        form.fields['orchestration'].queryset = qs.order_by('-collection_id', 'pk')
+        return form
+
     def form_valid(self, form):
         work = form.save(commit=False)
         #work.ensemble_id = self.request.ensemble_id
@@ -219,19 +226,12 @@ class WorkAddView(CollectionMixin, FormView):
         else:
             return redirect('work_detail', collection=self.collection.pk, pk=work.pk)
 
-class WorkMixin(object):
-
-    def get_queryset(self):
-        if self.request.is_admin:
-            return Work.objects.all()
-
-        return Work.objects.filter(collection__allowed_ensembles__ensemble=self.request.ensemble_id)
-
-class WorkDetailView(CollectionMixin, WorkMixin, DetailView):
+class WorkDetailView(CollectionMixin, DetailView):
     pass
 
-class WorkUpdateView(CollectionMixin, WorkMixin, UpdateView):
-    fields = ['name', 'composer', 'edition', 'code', 'licence', 'max_projects', 'running_time', 'notes']
+class WorkUpdateView(CollectionMixin, UpdateView):
+    #fields = ['name', 'composer', 'edition', 'code', 'orchestration', 'licence', 'max_projects', 'running_time', 'notes']
+    form_class = forms.WorkCreateForm
     template_name = 'interface/default_form.html'
 
     def get_success_url(self):
@@ -266,7 +266,7 @@ class WorkAddToProject(ProjectMixin, FormView):
 
     
 
-class WorkPartSetView(EnsembleMixin, DetailView):
+class WorkPartSetView(CollectionMixin, DetailView):
     template_name = "library/work_partset.html"
 
     def post(self, request, *args, **kwargs):

app/library/views/api.py

@@ -32,8 +32,7 @@ class WorkExportView(EnsembleMixin, WorkMixin, View):
 
 """
 
-from library.views import WorkMixin
-from interface.views import EnsembleMixin
+from interface.views import AuthorizedResourceMixin
 
 from rest_framework import routers, serializers, viewsets
 
@@ -168,25 +167,25 @@ class CollectionSerializer(serializers.Serializer):
 
 from rest_framework import generics
 
-class CollectionExportView(generics.RetrieveAPIView):
+class CollectionExportView(AuthorizedResourceMixin, generics.RetrieveAPIView):
     serializer_class = CollectionSerializer
 
     def get_queryset(self):
         return Collection.objects.filter(administrators=self.request.user)
 
-class WorkExportView(generics.RetrieveAPIView):
+class WorkExportView(AuthorizedResourceMixin, generics.RetrieveAPIView):
     serializer_class = WorkSerializer
 
     def get_queryset(self):
         return Work.objects.filter(collection__administrators=self.request.user)
 
-class WorkImportView(generics.CreateAPIView):
+class WorkImportView(AuthorizedResourceMixin, generics.CreateAPIView):
     serializer_class = WorkSerializer
 
     def perform_create(self, serializer):
         serializer.save(collection_id=self.kwargs['pk'])
 
-class CollectionImportView(generics.CreateAPIView):
+class CollectionImportView(AuthorizedResourceMixin, generics.CreateAPIView):
     serializer_class = CollectionSerializer
 
     def perform_create(self, serializer):