Repository: svthalia/concrexit

Issue:
Ordering food for an event you are not registered for
### Describe the bug
<!-- A clear and concise description of what the bug is. -->
You can order food for an event you are not registered for. I was not registered for the 'Spring Beach Party' but I could order food.

### Expected behaviour
<!-- A clear and concise description of what you expected to happen. -->
I expect you can only order food for an event you are registered for or an event where registration is not necessary.




Discussion:

Resolving patch:
diff --git a/website/pizzas/api/v2/views.py b/website/pizzas/api/v2/views.py
--- a/website/pizzas/api/v2/views.py
+++ b/website/pizzas/api/v2/views.py
@@ -1,8 +1,10 @@
 from django.db.models import Prefetch
+from django.utils import timezone
 
 from oauth2_provider.contrib.rest_framework import IsAuthenticatedOrTokenHasScope
 from rest_framework import filters as framework_filters
 from rest_framework import status
+from rest_framework.exceptions import PermissionDenied
 from rest_framework.generics import (
     CreateAPIView,
     DestroyAPIView,
@@ -141,7 +143,8 @@ def dispatch(self, request, *args, **kwargs):
 
     def update(self, request, *args, **kwargs):
         instance = self.get_object()
-
+        if instance.event.has_ended:
+            raise PermissionDenied
         if instance.payment:
             delete_payment(instance, member=request.member, ignore_change_window=True)
 
@@ -152,6 +155,19 @@ def update(self, request, *args, **kwargs):
         )
 
     def create(self, request, *args, **kwargs):
+        if self.food_event.start > timezone.now():
+            raise PermissionDenied("You cannot order food yet")
+        if self.food_event.has_ended:
+            raise PermissionDenied("Event has ended")
+
+        event = self.food_event.event
+        if event.registration_required:
+            registration = event.registrations.filter(
+                member=request.member, date_cancelled=None
+            ).first()
+            if registration is None or not registration.is_invited:
+                raise PermissionDenied("You are not registered for this event")
+
         serializer = self.get_serializer(data=request.data)
         serializer.is_valid(raise_exception=True)
         self.perform_create(serializer)
diff --git a/website/pizzas/views.py b/website/pizzas/views.py
--- a/website/pizzas/views.py
+++ b/website/pizzas/views.py
@@ -3,6 +3,7 @@
 from django.contrib.auth.decorators import login_required
 from django.http import Http404
 from django.shortcuts import get_object_or_404, redirect, render
+from django.utils import timezone
 from django.utils.translation import gettext_lazy as _
 from django.views.decorators.http import require_http_methods
 
@@ -23,7 +24,27 @@ def index(request):
         obj = FoodOrder.objects.get(food_event=event, member=request.member)
     except FoodOrder.DoesNotExist:
         obj = None
-    context = {"event": event, "products": products, "order": obj}
+
+    registrated_required = (
+        event is not None
+        and event.event is not None
+        and event.event.registration_required
+    )
+    not_registered = False
+    if registrated_required:
+        registration = event.event.registrations.filter(
+            member=request.member, date_cancelled=None
+        ).first()
+
+        if registration is None or not registration.is_invited:
+            not_registered = True
+
+    context = {
+        "event": event,
+        "products": products,
+        "order": obj,
+        "not_registered": not_registered,
+    }
     return render(request, "pizzas/index.html", context)
 
 
@@ -50,9 +71,23 @@ def cancel_order(request):
 def place_order(request):
     """View that shows the detail of the current order."""
     event = FoodEvent.current()
+
     if not event:
         return redirect("pizzas:index")
 
+    if event.start > timezone.now():
+        return redirect("pizzas:index")
+
+    if event.has_ended:
+        return redirect("pizzas:index")
+
+    if event.event.registration_required:
+        registration = event.event.registrations.filter(
+            member=request.member, date_cancelled=None
+        ).first()
+        if registration is None or not registration.is_invited:
+            return redirect("pizzas:index")
+
     try:
         obj = FoodOrder.objects.get(food_event=event, member=request.member)
         current_order_locked = not obj.can_be_changed


Test patch: