Allow only users in the database to reply by task id

pretasx/core/templates/core/tasks.html

@@ -13,6 +13,20 @@
 	</div>
 	<div class="level-right">
 		<div class="level-item">
+{% if request.resolver_match.url_name == "all_tasks" %}
+			{% translate "All" %}
+{% else %}
+			<a href="{% url 'all_tasks' %}">{% translate "All" %}</a>
+{% endif %}
+		</div>
+		<div class="level-item">
+{% if request.resolver_match.url_name == "tasks" %}
+			{% translate "Open" %}
+{% else %}
+			<a href="{% url 'tasks' %}">{% translate "Open" %}</a>
+{% endif %}
+		</div>
+		<div class="level-item">
 			<a class="button is-success" href="{% url 'create_task' %}">{% translate "New task" %}</a>
 		</div>
 	</div>

pretasx/core/urls.py

@@ -8,6 +8,7 @@ urlpatterns = [
     path("", views.index, name="index"),
     path("tags/<slug:slug>", views.tag, name="tag"),
     path("tasks", views.tasks, name="tasks"),
+    path("tasks/all", views.all_tasks, name="all_tasks"),
     path("tasks/new", views.create_task, name="create_task"),
     path("tasks/<int:task_id>", views.task, name="task"),
     path("tasks/<int:task_id>/edit", views.edit_task, name="edit_task"),

pretasx/core/views.py

@@ -57,6 +57,18 @@ def tag(request, slug):
 
 @login_required
 def tasks(request):
+    tasks = Task.objects.filter(
+        state__in=(Task.State.TODO, Task.State.IN_PROGRESS)
+    ).order_by("-updated_at")
+    pagination = paginate_tasks(
+        tasks, request.GET.get("per_page"), request.GET.get("page")
+    )
+
+    return render(request, "core/tasks.html", pagination)
+
+
+@login_required
+def all_tasks(request):
     tasks = Task.objects.order_by("-updated_at")
     pagination = paginate_tasks(
         tasks, request.GET.get("per_page"), request.GET.get("page")

pretasx/ingress/management/commands/processemail.py

@@ -1,3 +1,4 @@
+from django.contrib.auth.models import User
 from django.core.files.base import ContentFile
 from django.core.mail.utils import DNS_NAME
 from django.core.management.base import BaseCommand
@@ -35,6 +36,8 @@ class Command(BaseCommand):
             print("5.1.1 Unknown ingress endpoint")
             exit(1)
 
+        sender = options["sender"]
+
         try:
             msg = email.message_from_file(stdin, policy=email.policy.default)
         except email.errors.MessageParseError:
@@ -84,8 +87,16 @@ class Command(BaseCommand):
                 task = in_reply_to.task
             else:
                 try:
+                    task_id = int(options["extensions"][i])
+                except:
+                    task_id = None
+
+                # allow only users in the database to reply by task id
+                if not User.objects.filter(email=sender).exists():
+                    task_id = None
+
                 task, created = Task.objects.get_or_create(
-                        pk__exact=int(options["extensions"][i]),
+                    pk__exact=task_id,
                     defaults={
                         "title": title,
                         "state": endpoint.default_state,
@@ -96,18 +107,8 @@ class Command(BaseCommand):
                     task.tags.set(endpoint.default_tags.all())
                 else:
                     in_reply_to = task.comment_set.order_by("-created_at").first()
-                except ValueError:  # extension is empty or not an int
-                    task = Task.objects.create(
-                        title=title,
-                        state=endpoint.default_state,
-                        assignee=endpoint.default_assignee,
-                    )
-                    task.tags.set(endpoint.default_tags.all())
-                    created = True
 
-            TaskSubscription.objects.get_or_create(
+            TaskSubscription.objects.get_or_create(subscriber=sender, task=task)
-                subscriber=options["sender"], task=task
-            )
 
             comment = Comment.objects.create(
                 text=text,