Repository: dotkom/onlineweb4

Issue:
You can make an event for a group you're not in
**Describe the bug**
In the dashboard you can make an event for a group you're not in, and therefore you can not edit the event if you accidentally created it.

Example: Erlang Visloff is a part of Bedkom / Seniorkom, and because of that, he has access to the dashboard to create events. He wants to create an event for Greenline, since he loves plants. He makes an event for Greenline, but when he saves it to look it up later, he can no longer find it. He then has to contact one member of dotkom to find out he is not the group 'Interessegrupper', and therefore he can make an event for Interessegrupper, but can not edit the event.

**To Reproduce**
Steps to reproduce the behavior:
1. Go to 'Opprett Arrangement' in the Dashboard
2. Click on 'Arrangør' and see a list of the groups you can make an event for
3. Save the event
4. See that you can no longer edit it in the dashboard

**Expected behavior**
1. Go to 'Opprett Arrangement' in the Dashboard
2. Click on 'Arrangør' and see a list of the groups you are a part of
3. Save the event
4. See that you can edit it in the dashboard


Discussion:

Resolving patch:
diff --git a/apps/events/dashboard/forms.py b/apps/events/dashboard/forms.py
--- a/apps/events/dashboard/forms.py
+++ b/apps/events/dashboard/forms.py
@@ -1,6 +1,8 @@
 # -*- coding: utf-8 -*-
 
 from django import forms
+from django.contrib.auth.models import Group
+from guardian.shortcuts import get_perms_for_model
 
 from apps.dashboard.forms import HTML5RequiredMixin
 from apps.dashboard.widgets import (
@@ -15,6 +17,17 @@
 
 
 class CreateEventForm(forms.ModelForm, HTML5RequiredMixin):
+    def __init__(self, user, *args, **kwargs):
+        super().__init__(*args, **kwargs)
+        if not user.is_superuser:
+            # Only allow groups with permission to change events be put as organizer.
+            # Filter selectable groups by the group memberships of the current user.
+            event_perms = get_perms_for_model(Event)
+            event_organizer_groups = Group.objects.filter(
+                permissions__in=event_perms
+            ).distinct()
+            self.fields["organizer"].queryset = event_organizer_groups.filter(user=user)
+
     class Meta:
         model = Event
         fields = (
diff --git a/apps/events/dashboard/views.py b/apps/events/dashboard/views.py
--- a/apps/events/dashboard/views.py
+++ b/apps/events/dashboard/views.py
@@ -82,6 +82,12 @@ class CreateEventView(DashboardCreatePermissionMixin, CreateView):
     template_name = "events/dashboard/create.html"
     permission_required = "events.add_event"
 
+    def get_form_kwargs(self):
+        """Make the requesting user available to the form"""
+        kwargs = super().get_form_kwargs()
+        kwargs.update({"user": self.request.user})
+        return kwargs
+
     def get_success_url(self):
         return reverse("dashboard_event_details", kwargs={"event_id": self.object.id})
 
@@ -93,6 +99,12 @@ class UpdateEventView(DashboardObjectPermissionMixin, UpdateView):
     permission_required = "events.change_event"
     pk_url_kwarg = "event_id"
 
+    def get_form_kwargs(self):
+        """Make the requesting user available to the form"""
+        kwargs = super().get_form_kwargs()
+        kwargs.update({"user": self.request.user})
+        return kwargs
+
     def get_success_url(self):
         return reverse(
             "dashboard_event_details", kwargs={"event_id": self.kwargs.get("event_id")}


Test patch: