Merge pull request python#857 from malemburg/master

malemburg · malemburg · commit da96fee61bb5 · 2015-11-27T16:16:54.000+01:00
Disable anonymous postings by returning a 404.
diff --git a/jobs/tests/test_views.py b/jobs/tests/test_views.py
@@ -193,6 +193,10 @@ def test_job_create(self):
             'email': 'hr@company.com'
         }
 
+        # Check that anonymous posting is not allowed. See #852.
+        response = self.client.post(url, post_data)
+        self.assertEqual(response.status_code, 404)
+
         if 0:
             # Disabled for now, until we have found a better solution
             # to fight spammers. See #852.
diff --git a/jobs/views.py b/jobs/views.py
@@ -278,14 +278,14 @@ def get_form_kwargs(self):
 
     def form_valid(self, form):
         """ set the creator to the current user """
-        # Associate Job to user if they are logged in
-        if self.request.user.is_authenticated():
-            form.instance.creator = self.request.user
-        else:
-            # Temporary measure against spammers. See #852.
-            return super().form_invalid(form)
-        return super().form_valid(form)    
-        
+
+        # Don't allow anonymous postings; see #852.
+        if not self.request.user.is_authenticated():
+            raise Http404
+
+        # Associate Job to user
+        form.instance.creator = self.request.user
+        return super().form_valid(form)      
 
 
 class JobEdit(JobMixin, UpdateView):
