diff --git a/submissions/forms.py b/submissions/forms.py index 19cf53bb291a94963b5b85f4d05c08bf0fbeaba0..064196bd5764aaeefd18b791b0ae72ea1400d62f 100644 --- a/submissions/forms.py +++ b/submissions/forms.py @@ -2,7 +2,7 @@ from django import forms from django.core.validators import RegexValidator from .constants import ASSIGNMENT_BOOL, ASSIGNMENT_REFUSAL_REASONS,\ - REPORT_ACTION_CHOICES, REPORT_REFUSAL_CHOICES, SUBMISSION_CYCLES + REPORT_ACTION_CHOICES, REPORT_REFUSAL_CHOICES from .models import Submission, RefereeInvitation, Report, EICRecommendation from scipost.constants import SCIPOST_SUBJECT_AREAS @@ -77,6 +77,16 @@ class SubmissionForm(forms.ModelForm): 'placeholder': 'Optional: names of referees whose reports should be treated with caution (+ short reason)', 'rows': 3}) + def check_user_may_submit(self, current_user): + """ + Important check! + + The submitting user must be an author of the submission. + Also possibly may be extended to check permissions and give ultimate submission + power to certain user groups. + """ + return current_user.last_name in self.cleaned_data['author_list'] + def update_submission_data(self): """ Some fields should not be accessible in the HTML form by the user and should be diff --git a/submissions/views.py b/submissions/views.py index ce94d8f6cecd0b88133cd1c32a4914b707cbaeff..712898a5142a610a6ce2b03f320059eda141675c 100644 --- a/submissions/views.py +++ b/submissions/views.py @@ -109,28 +109,7 @@ class PrefillUsingIdentifierView(PermissionRequiredMixin, FormView): class SubmissionCreateView(PermissionRequiredMixin, CreateView): model = Submission - fields = [ - 'is_resubmission', - 'discipline', - 'submitted_to_journal', - 'submission_type', - 'domain', - 'subject_area', - 'secondary_areas', - 'title', - 'author_list', - 'abstract', - 'arxiv_identifier_w_vn_nr', - 'arxiv_identifier_wo_vn_nr', - 'arxiv_vn_nr', - 'arxiv_link', - 'metadata', - 'author_comments', - 'list_of_changes', - 'remarks_for_editors', - 'referees_suggested', - 'referees_flagged' - ] + form_class = SubmissionForm template_name = 'submissions/new_submission.html' permission_required = 'scipost.can_submit_manuscript' @@ -148,6 +127,15 @@ class SubmissionCreateView(PermissionRequiredMixin, CreateView): submitted_by = Contributor.objects.get(user=self.request.user) form.instance.submitted_by = submitted_by + # Temporary until moved to new Arxiv Caller + # Check submitting user for authorship ! + # With the new Arxiv caller, this message should already be given in the prefil form! + if not form.check_user_may_submit(self.request.user): + msg = ('Your name does not match that of any of the authors. ' + 'You are not authorized to submit this preprint.') + messages.error(self.request, msg) + return redirect('submissions:prefill_using_identifier') + # Save all the information contained in the form submission = form.save()