now rid is not the position argument. it is request id.

3 files changed, 32 insertions, 9 deletions

diff --git a/taskapp/utilities/request.py b/taskapp/utilities/request.py
index 7c7af70..6ebb35f 100644
--- a/taskapp/utilities/request.py
+++ b/taskapp/utilities/request.py
@@ -1,4 +1,5 @@
 from datetime import datetime
+
 from django.contrib.auth.models import User
 from pytask.taskapp.models import Request, Profile
 
@@ -29,3 +30,21 @@ def create_request(sent_by,role,sent_to=None,task=None,receiving_user=None,pynts
         req.sent_to.add(sent_to)
     req.save()
 
+def get_request(rid, user):
+    """ see if the request is replied or if he can not view the request,
+    raise 404 error. else return request.
+    """
+
+    try:
+        request_obj = Request.objects.get(id=rid)
+    except Request.DoesNotExist:
+        return None
+
+    if request_obj.is_replied == True:
+        return None
+    else:
+        try:
+            request_obj.sent_to.get(id=user.id)
+        except User.DoesNotExist:
+            return None
+        return request_obj
diff --git a/taskapp/views/user.py b/taskapp/views/user.py
index 27dbc81..0af117b 100644
--- a/taskapp/views/user.py
+++ b/taskapp/views/user.py
@@ -9,6 +9,7 @@ from pytask.taskapp.models import Task, Profile, Request
 from pytask.taskapp.events.user import createUser, updateProfile
 from pytask.taskapp.forms.user import UserProfileEditForm
 from pytask.taskapp.events.request import reply_to_request
+from pytask.taskapp.utilities.request import get_request
 
 def show_msg(user, message, redirect_url=None, url_desc=None):
     """ simply redirect to homepage """
@@ -104,10 +105,9 @@ def edit_my_profile(request):
 def browse_requests(request):
     
     user = request.user
-    active_reqs = user.request_sent_to.filter(is_replied=False)
+    active_reqs = user.request_sent_to.filter(is_replied=False).exclude(is_valid=False)
     reqs = active_reqs.order_by('creation_date').reverse()
-    for pos, req in enumerate(reversed(reqs)):
-        req.pos = pos
+
     context = {
         'user':user,
         'reqs':reqs,
@@ -122,8 +122,10 @@ def view_request(request, rid):
     """
 
     user = request.user
-    reqs = user.request_sent_to.filter(is_replied=False).order_by('creation_date')
-    user_request = reqs[int(rid)]
+    user_request = get_request(rid, user)
+    if not user_request:
+        raise Http404
+
     user_request.is_read = True
     user_request.save()
 
@@ -142,11 +144,13 @@ def process_request(request, rid, reply):
     """
 
     user = request.user
+    browse_request_url= '/user/requests'
+    req_obj = get_request(rid, user)
+
+    if not req_obj:
+        return show_msg(user, "Your reply has been processed", browse_request_url, "view other requests")
 
     if request.method=="POST":
-        browse_request_url= '/user/requests'
-        reqs = user.request_sent_to.filter(is_replied=False).order_by('creation_date')
-        req_obj = reqs[int(rid)]
         reply = True if reply == "yes" else False
         req_obj.remarks = request.POST.get('remarks', "")
         req_obj.save()
diff --git a/templates/user/browse_requests.html b/templates/user/browse_requests.html
index 6f136aa..fca0763 100644
--- a/templates/user/browse_requests.html
+++ b/templates/user/browse_requests.html
@@ -4,7 +4,7 @@
         You have no unreplied requests.
     {% else %}
         {% for req in reqs %}
-            <form><a href="/user/requests/rid={{req.pos}}">
+            <form><a href="/user/requests/rid={{req.id}}">
             {% if not req.is_read %}<b>{% endif %}{{req.sent_by.username}}|{{req.role}}|
             {% ifequal req.role "PY" %}            
                 {{req.task.title}}