OWASP-BLT · DonnieBLT · Apr 3, 2025 · Apr 2, 2025 · Apr 2, 2025 · Apr 2, 2025
diff --git a/blt/urls.py b/blt/urls.py
@@ -277,13 +277,13 @@
 from website.views.slack_handlers import slack_commands, slack_events
 from website.views.social import queue_social_view
 from website.views.teams import (
+    GiveKudosView,
     TeamChallenges,
     TeamLeaderboard,
     TeamOverview,
     add_member,
     create_team,
     delete_team,
-    give_kudos,
     join_requests,
     kick_member,
     leave_team,
@@ -996,7 +996,7 @@
     path("teams/delete-team/", delete_team, name="delete_team"),
     path("teams/leave-team/", leave_team, name="leave_team"),
     path("teams/kick-member/", kick_member, name="kick_member"),
-    path("teams/give-kudos/", give_kudos, name="give_kudos"),
+    path("teams/give-kudos/", GiveKudosView.as_view(), name="give_kudos"),
     path(
         "similarity_scan/",
         TemplateView.as_view(template_name="similarity_scan.html"),

diff --git a/website/migrations/0235_alter_lecture_content_alter_lecture_instructor.py b/website/migrations/0235_alter_lecture_content_alter_lecture_instructor.py
@@ -0,0 +1,25 @@
+# Generated by Django 5.1.7 on 2025-03-29 11:27
+
+import django.db.models.deletion
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("website", "0234_githubissue_linked_pull_requests"),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name="lecture",
+            name="content",
+            field=models.TextField(blank=True, null=True),
+        ),
+        migrations.AlterField(
+            model_name="lecture",
+            name="instructor",
+            field=models.ForeignKey(
+                blank=True, null=True, on_delete=django.db.models.deletion.CASCADE, to="website.userprofile"
+            ),
+        ),
+    ]
diff --git a/website/templates/team_overview.html b/website/templates/team_overview.html
@@ -671,6 +671,9 @@ <h2 class="text-2xl font-bold text-gray-800">Send Kudos</h2>
             const receiver = document.getElementById('kudosReceiver').value;
             const linkUrl = document.getElementById('kudosLink').value.trim();
             const commentText = document.getElementById('kudosComment').value.trim();
+            const userUsername = "{{ request.user.username|default:'' }}";
+            const sender = userUsername || "{{ user.username }}";
+            console.log(sender)
             fetch("/teams/give-kudos/", { 
                 method: "POST",
                 headers: {
@@ -679,6 +682,7 @@ <h2 class="text-2xl font-bold text-gray-800">Send Kudos</h2>
                 },
                 body: JSON.stringify({
                     kudosReceiver: receiver,
+                    kudosSender: sender,
                     link: linkUrl,
                     comment: commentText
                 })

diff --git a/website/views/teams.py b/website/views/teams.py
@@ -11,6 +11,8 @@
 
 # Create your views here.
 from django.views.generic import TemplateView
+from rest_framework.response import Response
+from rest_framework.views import APIView
 
 from website.models import Challenge, JoinRequest, Kudos, Organization
 
@@ -221,28 +223,37 @@ def kick_member(request):
     return JsonResponse({"success": False, "error": "Invalid request method"})
 
 
-@login_required
-def give_kudos(request):
-    if request.method == "POST":
+class GiveKudosView(APIView):
+    authentication_classes = []  # No authentication required
+    permission_classes = []  # No permissions required
+
+    def post(self, request):
         try:
-            data = json.loads(request.body)
+            data = request.data  # DRF automatically parses JSON request data
             receiver_username = data.get("kudosReceiver")
+            sender_username = data.get("kudosSender")  # Sender comes from request data
             link_url = data.get("link")
             comment_text = data.get("comment", "")
-        except json.JSONDecodeError:
-            return JsonResponse({"success": False, "error": "Invalid request data"})
 
-        if receiver_username:
-            try:
-                receiver = User.objects.get(username=receiver_username)
-                Kudos.objects.create(sender=request.user, receiver=receiver, link=link_url, comment=comment_text)
-                return JsonResponse({"success": True, "message": "Kudos sent successfully!"})
-            except User.DoesNotExist:
-                return JsonResponse({"success": False, "error": "User does not exist"})
+            if not receiver_username:
+                return Response({"success": False, "error": "Missing receiver"}, status=400)
+            if not sender_username:
+                return Response({"success": False, "error": "Missing sender"}, status=400)
 
-        return JsonResponse({"success": False, "error": "Missing receiver or message"})
+            # Fetch sender and receiver
+            receiver = User.objects.filter(username=receiver_username).first()
+            sender = User.objects.filter(username=sender_username).first()
 
-    return JsonResponse({"success": False, "error": "Invalid request method"})
+            if not receiver or not sender:
+                return Response({"success": False, "error": "Invalid sender or receiver username"}, status=404)
+
+            # Create and store the Kudos
+            Kudos.objects.create(sender=sender, receiver=receiver, link=link_url, comment=comment_text)
+
+            return Response({"success": True, "message": "Kudos sent successfully!"}, status=201)
+
+        except Exception as e:
+            return Response({"success": False, "error": "Unexpected error,Check The BLT usernames "}, status=400)
 
 
 class TeamChallenges(TemplateView):