Repository: hedyorg/hedy

Issue:
[UI idea] Implement a 403 error page
**Idea incl level**
I would like to have a 403 page when a user tries to visit a page he/she isn't allowed to visit; returning an unauthorized error. Currently we simply return a string "unauthorized" and the corresponding 403 error code. It would be nice to have a specific page for this error code, similarly to the already implement 404 and 500 error code pages. Which can be found in #992.



Discussion:

Resolving patch:
diff --git a/app.py b/app.py
--- a/app.py
+++ b/app.py
@@ -538,10 +538,10 @@ def programs_page(request):
     from_user = request.args.get('user') or None
     if from_user and not is_admin(user):
         if not is_teacher(user):
-            return "unauthorized", 403
+            return utils.page_403 (TRANSLATIONS, render_main_menu('hedy'), username, g.lang, TRANSLATIONS.get_translations (g.lang, 'ui').get ('not_teacher'))
         students = DATABASE.get_teacher_students(username)
         if from_user not in students:
-            return "unauthorized", 403
+            return utils.page_403 (TRANSLATIONS, render_main_menu('hedy'), username, g.lang, TRANSLATIONS.get_translations (g.lang, 'ui').get ('not_enrolled'))
 
     texts=TRANSLATIONS.get_translations(g.lang, 'Programs')
     ui=TRANSLATIONS.get_translations(g.lang, 'ui')
@@ -1022,7 +1022,8 @@ def main_page(page):
                                    auth=TRANSLATIONS.get_translations(g.lang, 'Auth'), teacher_classes=teacher_classes,
                                    welcome_teacher=welcome_teacher, **front_matter)
         else:
-            return "unauthorized", 403
+            return utils.page_403 (TRANSLATIONS, render_main_menu('hedy'), current_user()['username'], g.lang, TRANSLATIONS.get_translations (g.lang, 'ui').get ('not_teacher'))
+
 
     return render_template('main-page.html', mkd=markdown, menu=menu, auth=TRANSLATIONS.get_translations(g.lang, 'Auth'), **front_matter)
 
diff --git a/utils.py b/utils.py
--- a/utils.py
+++ b/utils.py
@@ -199,6 +199,11 @@ def markdown_to_html_tags(markdown):
     soup = BeautifulSoup(_html, 'html.parser')
     return soup.find_all()
 
+def page_403(translations, menu, lang, username, *page_error):
+    if page_error:
+        page_error = page_error[0]
+    return render_template("403.html", menu=menu, username=username, auth=translations.get_translations(lang, 'Auth'), ui=translations.get_translations(lang, 'ui'), page_error=page_error or ''), 403
+
 def page_404(translations, menu, lang, username, *page_error):
     if page_error:
         page_error = page_error[0]
diff --git a/website/teacher.py b/website/teacher.py
--- a/website/teacher.py
+++ b/website/teacher.py
@@ -20,14 +20,15 @@ def routes (app, database):
     @requires_login
     def get_classes (user):
         if not is_teacher(user):
-            return 'Only teachers can retrieve classes', 403
+            return utils.page_403 (TRANSLATIONS, render_main_menu('hedy'), current_user()['username'], g.lang, TRANSLATIONS.get_translations (g.lang, 'ui').get ('retrieve_class'))
         return jsonify (DATABASE.get_teacher_classes (user ['username'], True))
 
     @app.route('/class/<class_id>', methods=['GET'])
     @requires_login
     def get_class (user, class_id):
+        app.logger.info('This is info output')
         if not is_teacher(user):
-            return 'Only teachers can retrieve classes', 403
+            return utils.page_403 (TRANSLATIONS, render_main_menu('hedy'), current_user()['username'], g.lang, TRANSLATIONS.get_translations (g.lang, 'ui').get ('retrieve_class'))
         Class = DATABASE.get_class (class_id)
         if not Class or Class ['teacher'] != user ['username']:
             return utils.page_404 (TRANSLATIONS, render_main_menu('my-profile'), current_user()['username'], g.lang, TRANSLATIONS.get_translations(g.lang, 'ui').get('no_such_class'))
@@ -166,7 +167,7 @@ def leave_class (user, class_id, student_id):
     @requires_login
     def get_class_info(user, class_id):
         if not is_teacher(user):
-            return 'Only teachers can retrieve classes', 403
+            return utils.page_403 (TRANSLATIONS, render_main_menu('hedy'), current_user()['username'], g.lang, TRANSLATIONS.get_translations (g.lang, 'ui').get ('retrieve_class'))
         Class = DATABASE.get_class(class_id)
         if not Class or Class['teacher'] != user['username']:
             return utils.page_404(TRANSLATIONS, render_main_menu('my-profile'), current_user()['username'], g.lang,


Test patch: