Repository: translate/pootle

Issue:
Hide detailed stats from not logged in users
Currently if you are not logged in you can get to the contributors statistics for the site.  This data is useful for the team and for managers but shouldn't be exposed to the general internet for a few reasons:
- Bots hose the site for questionable value
- It exposes personal details that aren't of value outside of the team

Suggested solution:
- Block the detailed stats link from the user profile page for not logged in users



Discussion:

Resolving patch:
diff --git a/pootle/apps/reports/views.py b/pootle/apps/reports/views.py
--- a/pootle/apps/reports/views.py
+++ b/pootle/apps/reports/views.py
@@ -12,6 +12,7 @@
 
 from django.conf import settings
 from django.contrib.auth import get_user_model
+from django.contrib.auth.decorators import login_required
 from django.core.exceptions import ImproperlyConfigured
 from django.core.urlresolvers import reverse
 from django.shortcuts import render_to_response
@@ -59,6 +60,10 @@
 class UserStatsView(NoDefaultUserMixin, UserObjectMixin, DetailView):
     template_name = 'user/stats.html'
 
+    @method_decorator(login_required)
+    def dispatch(self, request, *args, **kwargs):
+        return super(UserStatsView, self).dispatch(request, *args, **kwargs)
+
     def get_context_data(self, **kwargs):
         ctx = super(UserStatsView, self).get_context_data(**kwargs)
         now = make_aware(datetime.now())
@@ -76,6 +81,7 @@ def get_context_data(self, **kwargs):
 
 class UserActivityView(NoDefaultUserMixin, UserObjectMixin, DetailView):
 
+    @method_decorator(login_required)
     @method_decorator(ajax_required)
     def dispatch(self, request, *args, **kwargs):
         self.month = request.GET.get('month', None)
@@ -89,6 +95,7 @@ def get(self, *args, **kwargs):
 class UserDetailedStatsView(NoDefaultUserMixin, UserObjectMixin, DetailView):
     template_name = 'user/detailed_stats.html'
 
+    @method_decorator(login_required)
     def dispatch(self, request, *args, **kwargs):
         self.month = request.GET.get('month', None)
         self.user = request.user


Test patch:
diff --git a/tests/views/user.py b/tests/views/user.py
new file mode 100644
--- /dev/null
+++ b/tests/views/user.py
@@ -0,0 +1,35 @@
+# -*- coding: utf-8 -*-
+#
+# Copyright (C) Pootle contributors.
+#
+# This file is a part of the Pootle project. It is distributed under the GPL3
+# or later license. See the LICENSE file for a copy of the license and the
+# AUTHORS file for copyright and authorship information.
+
+import pytest
+
+
+@pytest.mark.django_db
+def test_user_stats_link(client, request_users):
+    user = request_users["user"]
+    if user.username != "nobody":
+        client.login(
+            username=user.username,
+            password=request_users["password"])
+    response = client.get("/user/member/")
+    assert (
+        ("user-detailed-stats" in response.content)
+        == (not user.is_anonymous()))
+
+
+@pytest.mark.django_db
+def test_user_stats_view(client, request_users):
+    user = request_users["user"]
+    if user.username != "nobody":
+        client.login(
+            username=user.username,
+            password=request_users["password"])
+    response = client.get("/user/member/stats/")
+    assert (
+        (response.status_code)
+        == (user.is_anonymous() and 302 or 200))