From: Magnus Hagander <magnus@hagander.net>
Date: Tue, 5 Nov 2024 14:47:11 +0000 (+0100)
Subject: Prevent signing up for volunteer slot when not a volunteer
X-Git-Url: http://git.postgresql.org/gitweb/static/gitweb.js?a=commitdiff_plain;h=ee8af129a6a17c4508fc5516d3f9cb2a34889b96;p=pgeu-system.git

Prevent signing up for volunteer slot when not a volunteer

This could happen when an admin goes through the backend interface to
reach the volunteer schedule, which would create entries that otherwise
are incomplete.
---

diff --git a/media/js/volsched.js b/media/js/volsched.js
index 6d0b5da5..d49909ff 100644
--- a/media/js/volsched.js
+++ b/media/js/volsched.js
@@ -15,7 +15,7 @@ function makebutton(op, txt) {
     return $('<button/>').addClass('btn btn-primary btn-xs assignment-status btn-op').data('op', op).text(txt ? txt : op);
 }
 
-function update_slot_info(slot, regid, is_admin) {
+function update_slot_info(slot, regid, is_admin, is_volunteer) {
     var masterrow = $('tr.slot-row[data-slotid="' + slot.id + '"]');
     var slotcounttd = masterrow.find('td.slot-count');
     var slotcountspan = masterrow.find('span.slot-count-val');
@@ -99,7 +99,7 @@ function update_slot_info(slot, regid, is_admin) {
             col.append(sel);
         }
         else {
-            if (!assigned_to_slot) {
+            if (!assigned_to_slot && is_volunteer) {
                 /* Can only add if not already added */
                 col.append(makebutton('signup', 'Sign up'));
             }
@@ -128,7 +128,7 @@ $(function() {
             'slotid': slotid,
             'volid': volid,
         }).success(function(data, status, xhr) {
-            update_slot_info(data.slot, regid, is_admin);
+            update_slot_info(data.slot, regid, is_admin, is_volunteer);
             update_stats(data.stats);
         }).fail(function(xhr) {
             try {
@@ -151,7 +151,7 @@ $(function() {
             'volid': event.target.value,
             'dataType': 'json',
         }).success(function(data, status, xhr) {
-            update_slot_info(data.slot, regid, is_admin);
+            update_slot_info(data.slot, regid, is_admin, is_volunteer);
             update_stats(data.stats);
         }).fail(function(xhr) {
             try {
@@ -169,6 +169,7 @@ $(function() {
         $.each(data.slots, function(idx, slot) {
             allVolunteers = data.volunteers;
             is_admin = data.meta.isadmin;
+            is_volunteer = data.meta.isvolunteer;
             regid = data.meta.regid;
             update_slot_info(slot, regid, is_admin);
             update_stats(data.stats);
diff --git a/postgresqleu/confreg/volsched.py b/postgresqleu/confreg/volsched.py
index 3dfbe64a..71e312ce 100644
--- a/postgresqleu/confreg/volsched.py
+++ b/postgresqleu/confreg/volsched.py
@@ -110,6 +110,7 @@ def volunteerschedule_api(request, urlname, adm=False):
             } for vol in conference.volunteers.all().order_by('firstname', 'lastname')],
             'meta': {
                 'isadmin': is_admin,
+                'isvolunteer': conference.volunteers.filter(pk=reg.pk).exists(),
                 'regid': reg.id,
             },
             'stats': _get_volunteer_stats(conference),
@@ -188,6 +189,8 @@ def _signup(request, conference, reg, adm, slot):
         return 409, "Volunteer slot is already full"
     elif VolunteerAssignment.objects.filter(reg=reg, slot__timerange__overlap=slot.timerange).exists():
         return 400, "Cannot sign up for an overlapping slot"
+    elif not conference.volunteers.filter(pk=reg.pk).exists():
+        return 400, "You are not a registered volunteer for this conference"
     else:
         a = VolunteerAssignment(slot=slot, reg=reg, vol_confirmed=True, org_confirmed=False)
         a.save()