Multiple fixes:

- Add views test cases in test_views.py
- Add minutes unit to preview_questionpaper template
- Add error handling in views when random user accesses questionpaper

3 files changed, 70 insertions, 2 deletions

diff --git a/yaksh/templates/yaksh/preview_questionpaper.html b/yaksh/templates/yaksh/preview_questionpaper.html
index 411e4a6..123218f 100644
--- a/yaksh/templates/yaksh/preview_questionpaper.html
+++ b/yaksh/templates/yaksh/preview_questionpaper.html
@@ -6,7 +6,7 @@
 <div class="well">
 	<div class="col-md-12">
 		<div class="col-md-6">Maximum Mark(s): {{ paper.total_marks }}</div>
-		<div class="col-md-6"><span class="pull-right">Total Time: {{ paper.quiz.duration }}</span></div>
+		<div class="col-md-6"><span class="pull-right">Total Time: {{ paper.quiz.duration }} minutes</span></div>
 	</div>
 </div>
 <div class="panel panel-default">
diff --git a/yaksh/test_views.py b/yaksh/test_views.py
index 3b27338..10cef81 100644
--- a/yaksh/test_views.py
+++ b/yaksh/test_views.py
@@ -4040,6 +4040,24 @@ class TestQuestionPaper(TestCase):
             timezone='UTC'
         )
 
+        self.user2_plaintext_pass = 'demo2'
+        self.user2 = User.objects.create_user(
+            username='demo_user2',
+            password=self.user_plaintext_pass,
+            first_name='first_name2',
+            last_name='last_name2',
+            email='demo2@test.com'
+        )
+
+        Profile.objects.create(
+            user=self.user2,
+            roll_number=11,
+            institute='IIT',
+            department='Chemical',
+            position='Student',
+            timezone='UTC'
+        )
+
         self.teacher_plaintext_pass = 'demo_teacher'
         self.teacher = User.objects.create_user(
             username='demo_teacher',
@@ -4194,6 +4212,54 @@ class TestQuestionPaper(TestCase):
         self.learning_module.delete()
         self.learning_unit.delete()
 
+    def test_preview_questionpaper_correct(self):
+        self.client.login(
+            username=self.user.username,
+            password=self.user_plaintext_pass
+        )
+
+        # Should successfully preview question paper
+        response = self.client.get(
+            reverse('yaksh:preview_questionpaper',
+                    kwargs={"questionpaper_id": self.question_paper.id}
+            )
+        )
+        self.assertEqual(response.status_code, 200)
+        self.assertTemplateUsed(response, 'yaksh/preview_questionpaper.html')
+        self.assertEqual(
+           response.context['questions'],
+           self.questions_list
+        )
+        self.assertEqual(response.context['paper'], self.question_paper)
+
+    def test_preview_questionpaper_without_moderator(self):
+        self.client.login(
+            username=self.user2.username,
+            password=self.user_plaintext_pass
+        )
+
+        # Should raise an HTTP 404 response
+        response = self.client.get(
+            reverse('yaksh:preview_questionpaper',
+                    kwargs={"questionpaper_id": self.question_paper.id}
+            )
+        )
+        self.assertEqual(response.status_code, 404)
+
+    def test_preview_qustionpaper_without_quiz_owner(self):
+        self.client.login(
+            username=self.teacher.username,
+            password=self.teacher_plaintext_pass
+        )
+
+        # Should raise an HTTP 404 response
+        response = self.client.get(
+            reverse('yaksh:preview_questionpaper',
+                    kwargs={"questionpaper_id": self.question_paper.id}
+            )
+        )
+        self.assertEqual(response.status_code, 404)
+
     def test_mcq_attempt_right_after_wrong(self):
         """ Case:- Check if answerpaper and answer marks are updated after
             attempting same mcq question with wrong answer and then right
diff --git a/yaksh/views.py b/yaksh/views.py
index 94335a2..2b3c891 100644
--- a/yaksh/views.py
+++ b/yaksh/views.py
@@ -1883,7 +1883,7 @@ def create_demo_course(request):
     user = request.user
     ci = RequestContext(request)
     if not is_moderator(user):
-        raise("You are not allowed to view this page")
+        raise Http404("You are not allowed to view this page")
     demo_course = Course()
     success = demo_course.create_demo(user)
     if success:
@@ -2754,6 +2754,8 @@ def preview_questionpaper(request, questionpaper_id):
     if not is_moderator(user):
         raise Http404('You are not allowed to view this page!')
     paper = QuestionPaper.objects.get(id=questionpaper_id)
+    if not paper.quiz.creator == user:
+        raise Http404('This questionpaper does not belong to you')
     context = {
         'questions': paper._get_questions_for_answerpaper(),
         'paper': paper,