From 2aed378814db59835249dd3ba5645e74a09cfb2c Mon Sep 17 00:00:00 2001
From: eric <eric@hellman.net>
Date: Tue, 22 Jul 2014 16:20:44 -0400
Subject: [PATCH 1/3] fix the root problem

---
 frontend/templates/download.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/frontend/templates/download.html b/frontend/templates/download.html
index 4de66af7..0114760a 100644
--- a/frontend/templates/download.html
+++ b/frontend/templates/download.html
@@ -74,7 +74,7 @@ $j(document).ready(function() {
         <ul class="social menu">
             {% with site.domain as domain %}
             <a href="https://www.facebook.com/sharer.php?u=https://{{ site.domain }}{% url work work.id|urlencode:"" %}"><li class="facebook first"><span>Facebook</span></li></a>
-            <a href="https://twitter.com/intent/tweet?url={{ request.build_absolute_uri|urlencode:"" }}&amp;text=I%27m%20enjoying%20{{ work.title|urlencode }}%2C%20a%20free%2C%20non%2DDRM%20ebook%2E%20You%20can%20too%21"><li class="twitter"><span>Twitter</span></li></a>
+            <a href="https://twitter.com/intent/tweet?url=https://{{ site.domain }}{% url work work.id|urlencode:"" %}&amp;text=I%27m%20enjoying%20{{ work.title|urlencode }}%2C%20a%20free%2C%20non%2DDRM%20ebook%2E%20You%20can%20too%21"><li class="twitter"><span>Twitter</span></li></a>
             {% endwith %}
             {% if request.user.is_authenticated %}<a href="{% url emailshare 'downloaded' %}?next={% url work work.id %}"><li class="email"><span>Email</span></li></a>{% endif %}
             <a id="embed2"><li class="embed"><span>Embed</span></li></a>

From 7377063b2cad74c54b48e5858fef5458edd31ad6 Mon Sep 17 00:00:00 2001
From: eric <eric@hellman.net>
Date: Tue, 22 Jul 2014 16:27:55 -0400
Subject: [PATCH 2/3] catch the exception actually thrown by bad tie

pass transaction on the object; not in context (style only)
move the redirect logic into get
---
 frontend/views.py | 80 +++++++++++++++++++++++------------------------
 1 file changed, 40 insertions(+), 40 deletions(-)

diff --git a/frontend/views.py b/frontend/views.py
index 536c9e0f..a8407499 100755
--- a/frontend/views.py
+++ b/frontend/views.py
@@ -1521,45 +1521,53 @@ class FundCompleteView(TemplateView):
     def get(self, request, *args, **kwargs):
         context = self.get_context_data(**kwargs)
         
-        # if there is a redirect URL calculated in get_context_data -- redirect to that URL
-        if context.get('redirect'):
-            return HttpResponseRedirect(context.get('redirect'))
-                        
-        if context['campaign'].type == THANKS:
-            return DownloadView.as_view()(request, work=context['work'])
-        else:
-            if request.user.is_authenticated:
-                return self.render_to_response(context)
+        if self.transaction:
+            if self.transaction.campaign.type == THANKS:
+                return DownloadView.as_view()(request, work=self.transaction.campaign.work)
+        
             else:
-                return redirect_to_login(request.get_full_path())
+                if request.user.is_authenticated:
+                    if self.user_is_ok():
+                        return self.render_to_response(context)
+                    else:
+                         return HttpResponseRedirect(reverse('work', kwargs={'work_id': self.transaction.campaign.work.id}))
+                else:
+                    return redirect_to_login(request.get_full_path())
+        else:
+            return HttpResponseRedirect(reverse('home'))
+    
+    def user_is_ok(self):
+        if not self.transaction:
+            return False   
+        if self.transaction.campaign.type == THANKS and self.transaction.user == None:
+            # to handle anonymous donors- leakage not an issue
+            return True
+        else: 
+            return self.request.user.id == self.transaction.user.id
         
             
 
     def get_context_data(self):
         # pick up all get and post parameters and display
         context = super(FundCompleteView, self).get_context_data()
-
+        self.transaction = None
+        
         # pull out the transaction id and try to get the corresponding Transaction
-        transaction_id = self.request.REQUEST.get("tid", "")
+        transaction_id = self.request.REQUEST.get("tid")
         
-        # be more forgiving of tid --> e.g., if there is a trailing "/"
-        
-        g = re.search("^(\d+)(\/?)$", transaction_id)
-        if g:
-            transaction_id=g.group(1)
-        else: # error -- redirect to home page
-            context['redirect'] = reverse('home')
+        if not transaction_id:
             return context
-
-        transaction = Transaction.objects.get(id=transaction_id)
-        # if there is no valid transaction, redirect home
-        if not transaction:
-            context['redirect'] = reverse('home')
+        try:
+            self.transaction = Transaction.objects.get(id=transaction_id)
+        except ValueError:
+            self.transaction = None
+            
+        if not self.transaction:
             return context
         
         # work and campaign in question
         try:
-            campaign = transaction.campaign
+            campaign = self.transaction.campaign
             work = campaign.work
         except Exception, e:
             campaign = None
@@ -1567,28 +1575,20 @@ class FundCompleteView(TemplateView):
             
         # # we need to check whether the user tied to the transaction is indeed the authenticated user.
         
-        if transaction.campaign.type == THANKS and transaction.user == None:
-            pass
-        elif self.request.user.id != transaction.user.id:
-            # let's redirect user to the work corresponding to the transaction if we can
-            if work:
-                context['redirect'] = reverse('work', kwargs={'work_id': work.id})
-            else:
-                context['redirect'] = reverse('home')
-                
+        if not self.user_is_ok():
             return context
         
         # add the work corresponding to the Transaction on the user's wishlist if it's not already on the wishlist
-        if transaction.user is not None and (campaign is not None) and (work is not None):
-            transaction.user.wishlist.add_work(work, 'pledging', notify=True)
+        if self.transaction.user is not None and (campaign is not None) and (work is not None):
+            self.transaction.user.wishlist.add_work(work, 'pledging', notify=True)
 
         #put info into session for download page to pick up.
-        self.request.session['amount']= transaction.amount
-        if transaction.receipt:
-            self.request.session['receipt']= transaction.receipt
+        self.request.session['amount']= self.transaction.amount
+        if self.transaction.receipt:
+            self.request.session['receipt']= self.transaction.receipt
                 
             
-        context["transaction"] = transaction
+        context["transaction"] = self.transaction
         context["work"] = work
         context["campaign"] = campaign
         context["faqmenu"] = "complete"

From 5a5b47b180aa23402a2530e799cedbc1808d18de Mon Sep 17 00:00:00 2001
From: Raymond Yee <raymond.yee@gmail.com>
Date: Wed, 23 Jul 2014 10:07:49 -0700
Subject: [PATCH 3/3] Also catch Transaction.DoesNotExist in FundCompleteView

---
 frontend/views.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/frontend/views.py b/frontend/views.py
index a8407499..c1ad6ba3 100755
--- a/frontend/views.py
+++ b/frontend/views.py
@@ -1559,7 +1559,7 @@ class FundCompleteView(TemplateView):
             return context
         try:
             self.transaction = Transaction.objects.get(id=transaction_id)
-        except ValueError:
+        except (ValueError, Transaction.DoesNotExist):
             self.transaction = None
             
         if not self.transaction: