Do not allow anonymous contact forms (#3842)

Author: itsisak

lego/apps/contact/send.py

@@ -3,29 +3,28 @@
 from lego.utils.tasks import send_email
 
 
-def send_message(title, message, user, anonymous, recipient_group):
+def send_message(title, message, user, recipient_group):
     """
     Send a message to HS when users posts to the contact form.
     Don't catch AbakusGroup.DoesNotExist, this notifies us when the group doesn't exist.
     """
-    anonymous = anonymous if user.is_authenticated else True
+
+    if not user or user.is_anonymous:
+        raise ValueError("User must be authenticated")
 
     # Handle no recipient group as HS
     if not recipient_group:
         recipient_group = AbakusGroup.objects.get(name="Hovedstyret")
 
     recipient_emails = get_recipients(recipient_group)
 
-    from_name = "Anonymous" if anonymous else user.full_name
-    from_email = "Unknown" if anonymous else user.email_address
-
     send_email.delay(
         to_email=recipient_emails,
         context={
             "title": title,
             "message": message,
-            "from_name": from_name,
-            "from_email": from_email,
+            "from_name": user.full_name,
+            "from_email": user.email_address,
             "recipient_group": recipient_group.__str__(),
         },
         subject=f"Ny henvendelse fra kontaktskjemaet til {recipient_group.__str__()}",

lego/apps/contact/serializers.py

@@ -10,7 +10,6 @@
 class ContactFormSerializer(serializers.Serializer):
     title = serializers.CharField(max_length=80)
     message = serializers.CharField()
-    anonymous = serializers.BooleanField()
     captcha_response = serializers.CharField()
     recipient_group = PrimaryKeyRelatedFieldNoPKOpt(
         allow_null=True,
@@ -23,8 +22,3 @@ def validate_captcha_response(self, captcha_response):
         if not verify_captcha(captcha_response):
             raise exceptions.ValidationError("invalid_captcha")
         return captcha_response
-
-    def validate_anonymous(self, anonymous):
-        if not self.context["request"].user.is_authenticated and not anonymous:
-            raise exceptions.ValidationError("anonymous_required_without_auth")
-        return anonymous

lego/apps/contact/tests/test_send.py

@@ -31,58 +31,14 @@ def setUp(self):
 
         self.webkom_leader = membership.user
 
-    @mock.patch("lego.apps.contact.send.send_email.delay")
-    def test_send_anonymous(self, mock_send_email):
-        """
-        Send in a contact form as not logged in user, set to be anonymous
-        """
-        anonymus_user = AnonymousUser()
-
-        send_message("title", "message", anonymus_user, True, self.webkom_group)
-        mock_send_email.assert_called_with(
-            to_email=[self.webkom_leader.email_address],
-            context={
-                "title": "title",
-                "message": "message",
-                "from_name": "Anonymous",
-                "from_email": "Unknown",
-                "recipient_group": self.webkom_group.__str__(),
-            },
-            subject=f"Ny henvendelse fra kontaktskjemaet til {self.webkom_group.__str__()}",
-            **default_values,
-        )
-        mock_send_email.assert_called_once()
-
-    @mock.patch("lego.apps.contact.send.send_email.delay")
-    def test_send_anonymous_user(self, mock_send_email):
-        """
-        Send in a contact form as not logged in user
-        """
-        anonymus_user = AnonymousUser()
-
-        send_message("title", "message", anonymus_user, False, self.webkom_group)
-        mock_send_email.assert_called_with(
-            to_email=[self.webkom_leader.email_address],
-            context={
-                "title": "title",
-                "message": "message",
-                "from_name": "Anonymous",
-                "from_email": "Unknown",
-                "recipient_group": self.webkom_group.__str__(),
-            },
-            subject=f"Ny henvendelse fra kontaktskjemaet til {self.webkom_group.__str__()}",
-            **default_values,
-        )
-        mock_send_email.assert_called_once()
-
     @mock.patch("lego.apps.contact.send.send_email.delay")
     def test_send_user(self, mock_send_email):
         """
         Send in a contact form as logged in user, showing name
         """
         logged_in_user = User.objects.first()
 
-        send_message("title", "message", logged_in_user, False, self.webkom_group)
+        send_message("title", "message", logged_in_user, self.webkom_group)
         mock_send_email.assert_called_with(
             to_email=[self.webkom_leader.email_address],
             context={
@@ -98,43 +54,32 @@ def test_send_user(self, mock_send_email):
         mock_send_email.assert_called_once()
 
     @mock.patch("lego.apps.contact.send.send_email.delay")
-    def test_send_user_set_anonymous(self, mock_send_email):
+    def test_send_anonymous(self, mock_send_email):
         """
-        Send in a contact form as logged in user, set to be anonymous
+        Ensure anonymous users can not send messages
         """
-        logged_in_user = User.objects.first()
+        anonymus_user = AnonymousUser()
 
-        send_message("title", "message", logged_in_user, True, self.webkom_group)
-        mock_send_email.assert_called_with(
-            to_email=[self.webkom_leader.email_address],
-            context={
-                "title": "title",
-                "message": "message",
-                "from_name": "Anonymous",
-                "from_email": "Unknown",
-                "recipient_group": self.webkom_group.__str__(),
-            },
-            subject=f"Ny henvendelse fra kontaktskjemaet til {self.webkom_group.__str__()}",
-            **default_values,
-        )
-        mock_send_email.assert_called_once()
+        with self.assertRaises(ValueError):
+            send_message("title", "message", anonymus_user, self.webkom_group)
+        mock_send_email.assert_not_called()
 
     @mock.patch("lego.apps.contact.send.send_email.delay")
     def test_send_to_hs(self, mock_send_email):
         """
         Send in a contact form to HS by passing `None` as recipient
         """
-        anonymus_user = AnonymousUser()
+        logged_in_user = User.objects.first()
         hs_group = AbakusGroup.objects.get(name="Hovedstyret")
 
-        send_message("title", "message", anonymus_user, True, None)
+        send_message("title", "message", logged_in_user, None)
         mock_send_email.assert_called_with(
             to_email=["[email protected]"],
             context={
                 "title": "title",
                 "message": "message",
-                "from_name": "Anonymous",
-                "from_email": "Unknown",
+                "from_name": logged_in_user.full_name,
+                "from_email": logged_in_user.email_address,
                 "recipient_group": hs_group.__str__(),
             },
             subject=f"Ny henvendelse fra kontaktskjemaet til {hs_group.__str__()}",
@@ -151,14 +96,14 @@ def test_send_to_group_with_several_leaders(self, mock_send_email):
 
         self.webkom_group.add_user(logged_in_user, role=LEADER)
 
-        send_message("title", "message", logged_in_user, True, self.webkom_group)
+        send_message("title", "message", logged_in_user, self.webkom_group)
         mock_send_email.assert_called_with(
             to_email=[self.webkom_leader.email_address, logged_in_user.email_address],
             context={
                 "title": "title",
                 "message": "message",
-                "from_name": "Anonymous",
-                "from_email": "Unknown",
+                "from_name": logged_in_user.full_name,
+                "from_email": logged_in_user.email_address,
                 "recipient_group": self.webkom_group.__str__(),
             },
             subject=f"Ny henvendelse fra kontaktskjemaet til {self.webkom_group.__str__()}",
@@ -175,14 +120,14 @@ def test_is_only_sent_to_leader(self, mock_send_email):
 
         self.webkom_group.add_user(logged_in_user, role=MEMBER)
 
-        send_message("title", "message", logged_in_user, True, self.webkom_group)
+        send_message("title", "message", logged_in_user, self.webkom_group)
         mock_send_email.assert_called_with(
             to_email=[self.webkom_leader.email_address],
             context={
                 "title": "title",
                 "message": "message",
-                "from_name": "Anonymous",
-                "from_email": "Unknown",
+                "from_name": logged_in_user.full_name,
+                "from_email": logged_in_user.email_address,
                 "recipient_group": self.webkom_group.__str__(),
             },
             subject=f"Ny henvendelse fra kontaktskjemaet til {self.webkom_group.__str__()}",

lego/apps/contact/tests/test_views.py

@@ -26,23 +26,6 @@ def test_without_auth(self, mock_verify_captcha, mock_send_message):
             {
                 "title": "title",
                 "message": "message",
-                "anonymous": True,
-                "captcha_response": "test",
-                "recipient_group": None,
-            },
-        )
-        self.assertEqual(status.HTTP_202_ACCEPTED, response.status_code)
-        mock_verify_captcha.assert_called_once()
-
-    @mock.patch("lego.apps.contact.views.send_message")
-    @mock.patch("lego.apps.contact.serializers.verify_captcha", return_value=True)
-    def test_without_auth_not_anonymous(self, mock_verify_captcha, mock_send_message):
-        response = self.client.post(
-            self.url,
-            {
-                "title": "title",
-                "message": "message",
-                "anonymous": False,
                 "captcha_response": "test",
                 "recipient_group": None,
             },
@@ -58,16 +41,13 @@ def test_with_auth(self, mock_verify_captcha, mock_send_message):
             {
                 "title": "title",
                 "message": "message",
-                "anonymous": True,
                 "captcha_response": "test",
                 "recipient_group": None,
             },
         )
         self.assertEqual(status.HTTP_202_ACCEPTED, response.status_code)
         mock_verify_captcha.assert_called_once()
-        mock_send_message.assert_called_once_with(
-            "title", "message", self.user, True, None
-        )
+        mock_send_message.assert_called_once_with("title", "message", self.user, None)
 
     @mock.patch("lego.apps.contact.views.send_message")
     @mock.patch("lego.apps.contact.serializers.verify_captcha", return_value=False)
@@ -78,7 +58,6 @@ def test_with_auth_invalid_captcha(self, mock_verify_captcha, mock_send_message)
             {
                 "title": "title",
                 "message": "message",
-                "anonymous": True,
                 "captcha_response": "test",
                 "recipient_group": None,
             },
@@ -99,13 +78,10 @@ def test_committee_as_recipient(self, mock_verify_captcha, mock_send_message):
             {
                 "title": "title",
                 "message": "message",
-                "anonymous": True,
                 "captcha_response": "test",
                 "recipient_group": webkom_id,
             },
         )
         self.assertEqual(status.HTTP_202_ACCEPTED, response.status_code)
         mock_verify_captcha.assert_called_once()
-        mock_send_message.assert_called_once_with(
-            "title", "message", self.user, True, webkom
-        )
+        mock_send_message.assert_called_once_with("title", "message", self.user, webkom)

lego/apps/contact/views.py

@@ -10,15 +10,18 @@ class ContactFormViewSet(viewsets.GenericViewSet):
     serializer_class = ContactFormSerializer
 
     def create(self, request):
+
+        if not request.user or request.user.is_anonymous:
+            return Response(status=status.HTTP_400_BAD_REQUEST)
+
         serializer = self.get_serializer(data=request.data)
         serializer.is_valid(raise_exception=True)
 
         title = serializer.validated_data["title"]
         message = serializer.validated_data["message"]
-        anonymous = serializer.validated_data["anonymous"]
         recipient_group = serializer.validated_data["recipient_group"]
 
-        send_message(title, message, request.user, anonymous, recipient_group)
+        send_message(title, message, request.user, recipient_group)
 
         if recipient_group:
             serializer.validated_data["recipient_group"] = recipient_group.id