Repository: e-valuation/EvaP

Issue:
Check MEDIA_URL setting
We need MEDIA_ROOT since files are uploaded for importing, and also grades. the former are not downloaded at all, the latter are downloaded only via sendfiles.

Therefore we probably don't need the MEDIA_URL setting, since no files are directly downloaded. We probably also don't need [this code in the urls.py](https://github.com/fsr-itse/EvaP/blob/master/evap/urls.py#L23). If we do, it should be [updated](https://docs.djangoproject.com/en/2.0/howto/static-files/#serving-files-uploaded-by-a-user-during-development).


Discussion:
The `MEDIA_URL` is currently used when editing an already uploaded grade document. The file field in the form shows the uploaded file with a direct link.
So what do you suggest?
summary of our discussion:

the direct link is not good since it circumvents django permission checking and lets everyone download the grade documents.

on production, that part of the server config was disabled for quite some time.

we should make this a django view, the only question is how to put that into a form field.

and then we can remove the MEDIA_URL setting.
the easiest way is probably to override the template of the widget and let that template use the url to our view.

the underlying problem is that the default widget for FileFields is the ClearableFileInput widget, which renders a url using the MEDIA_URL setting (at least it looks like that to me). we are not using MEDIA_URL but instead our views with django-sendfile.

one could use some mod_wsgi configuration to use MEDIA_URL and let apache and mod_wsgi do the authorization, but i'm not sure how that would work during development without apache and we can simply stick to the existing solution instead.

Resolving patch:
diff --git a/evap/grades/forms.py b/evap/grades/forms.py
--- a/evap/grades/forms.py
+++ b/evap/grades/forms.py
@@ -5,6 +5,10 @@
 from evap.grades.models import GradeDocument
 
 
+class GradeDocumentFileWidget(forms.widgets.ClearableFileInput):
+    template_name = 'grade_document_file_widget.html'
+
+
 class GradeDocumentForm(forms.ModelForm):
     # see CourseForm (staff/forms.py) for details, why the following two fields are needed
     last_modified_time_2 = forms.DateTimeField(label=_("Last modified"), required=False, localize=True, disabled=True)
@@ -13,6 +17,7 @@ class GradeDocumentForm(forms.ModelForm):
     class Meta:
         model = GradeDocument
         fields = ('description_de', 'description_en', 'file', 'last_modified_time_2', 'last_modified_user_2')
+        widgets = {'file': GradeDocumentFileWidget()}
 
     def __init__(self, *args, **kwargs):
         super().__init__(*args, **kwargs)
diff --git a/evap/settings.py b/evap/settings.py
--- a/evap/settings.py
+++ b/evap/settings.py
@@ -205,7 +205,6 @@
                 "django.contrib.auth.context_processors.auth",
                 "django.template.context_processors.debug",
                 "django.template.context_processors.i18n",
-                "django.template.context_processors.media",
                 "django.template.context_processors.static",
                 "django.template.context_processors.request",
                 "django.contrib.messages.context_processors.messages",
@@ -296,9 +295,6 @@
 # Absolute filesystem path to the directory that will hold user-uploaded files.
 MEDIA_ROOT = os.path.join(BASE_DIR, "upload")
 
-# URL that handles the media served from MEDIA_ROOT.
-MEDIA_URL = '/media/'
-
 # the backend used for downloading attachments
 # see https://github.com/johnsensible/django-sendfile for further information
 SENDFILE_BACKEND = 'sendfile.backends.simple'


Test patch: