start refactoring views.py

cms/djangoapps/contentstore/views/__init__.py

+from new import *
+from error import *
+from course import *
+from item import *
+from public import *
+from user import *
+from preview import *
+from assets import *
+from checklist import *
+from requests import landing
+
+
+"""
+
+from main import *
+
+"""

cms/djangoapps/contentstore/views/access.py

+#from auth.authz import is_user_in_course_group_role, get_users_in_course_group_by_role
+#from auth.authz import get_user_by_email, add_user_to_course_group, remove_user_from_course_group
+#from auth.authz import INSTRUCTOR_ROLE_NAME, STAFF_ROLE_NAME, create_all_course_groups
+
+from auth.authz import STAFF_ROLE_NAME, INSTRUCTOR_ROLE_NAME
+from auth.authz import is_user_in_course_group_role
+from contentstore.utils import get_course_location_for_item
+
+
+def get_location_and_verify_access(request, org, course, name):
+    """
+    Create the location tuple verify that the user has permissions
+    to view the location. Returns the location.
+    """
+    location = ['i4x', org, course, 'course', name]
+
+    # check that logged in user has permissions to this item
+    if not has_access(request.user, location):
+        raise PermissionDenied()
+
+    return location
+
+
+def has_access(user, location, role=STAFF_ROLE_NAME):
+    '''
+    Return True if user allowed to access this piece of data
+    Note that the CMS permissions model is with respect to courses
+    There is a super-admin permissions if user.is_staff is set
+    Also, since we're unifying the user database between LMS and CAS,
+    I'm presuming that the course instructor (formally known as admin)
+    will not be in both INSTRUCTOR and STAFF groups, so we have to cascade our queries here as INSTRUCTOR
+    has all the rights that STAFF do
+    '''
+    course_location = get_course_location_for_item(location)
+    _has_access = is_user_in_course_group_role(user, course_location, role)
+    # if we're not in STAFF, perhaps we're in INSTRUCTOR groups
+    if not _has_access and role == STAFF_ROLE_NAME:
+        _has_access = is_user_in_course_group_role(user, course_location, INSTRUCTOR_ROLE_NAME)
+    return _has_access

cms/djangoapps/contentstore/views/assets.py

+from django.http import HttpResponse, HttpResponseBadRequest
+from django.contrib.auth.decorators import login_required
+from django_future.csrf import ensure_csrf_cookie
+
+from xmodule.contentstore.content import StaticContent
+from access import get_location_and_verify_access
+from xmodule.util.date_utils import get_default_time_display
+from mitxmako.shortcuts import render_to_response
+
+
+@login_required
+@ensure_csrf_cookie
+def asset_index(request, org, course, name):
+    """
+    Display an editable asset library
+
+    org, course, name: Attributes of the Location for the item to edit
+    """
+    location = get_location_and_verify_access(request, org, course, name)
+
+    upload_asset_callback_url = reverse('upload_asset', kwargs={
+        'org': org,
+        'course': course,
+        'coursename': name
+    })
+
+    course_module = modulestore().get_item(location)
+
+    course_reference = StaticContent.compute_location(org, course, name)
+    assets = contentstore().get_all_content_for_course(course_reference)
+
+    # sort in reverse upload date order
+    assets = sorted(assets, key=lambda asset: asset['uploadDate'], reverse=True)
+
+    asset_display = []
+    for asset in assets:
+        id = asset['_id']
+        display_info = {}
+        display_info['displayname'] = asset['displayname']
+        display_info['uploadDate'] = get_default_time_display(asset['uploadDate'].timetuple())
+
+        asset_location = StaticContent.compute_location(id['org'], id['course'], id['name'])
+        display_info['url'] = StaticContent.get_url_path_from_location(asset_location)
+
+        # note, due to the schema change we may not have a 'thumbnail_location' in the result set
+        _thumbnail_location = asset.get('thumbnail_location', None)
+        thumbnail_location = Location(_thumbnail_location) if _thumbnail_location is not None else None
+        display_info['thumb_url'] = StaticContent.get_url_path_from_location(thumbnail_location) if thumbnail_location is not None else None
+
+        asset_display.append(display_info)
+
+    return render_to_response('asset_index.html', {
+        'active_tab': 'assets',
+        'context_course': course_module,
+        'assets': asset_display,
+        'upload_asset_callback_url': upload_asset_callback_url
+    })
+
+
+def upload_asset(request, org, course, coursename):
+    '''
+    cdodge: this method allows for POST uploading of files into the course asset library, which will
+    be supported by GridFS in MongoDB.
+    '''
+    if request.method != 'POST':
+        # (cdodge) @todo: Is there a way to do a - say - 'raise Http400'?
+        return HttpResponseBadRequest()
+
+    # construct a location from the passed in path
+    location = get_location_and_verify_access(request, org, course, coursename)
+
+    # Does the course actually exist?!? Get anything from it to prove its existance
+
+    try:
+        modulestore().get_item(location)
+    except:
+        # no return it as a Bad Request response
+        logging.error('Could not find course' + location)
+        return HttpResponseBadRequest()
+
+    # compute a 'filename' which is similar to the location formatting, we're using the 'filename'
+    # nomenclature since we're using a FileSystem paradigm here. We're just imposing
+    # the Location string formatting expectations to keep things a bit more consistent
+
+    filename = request.FILES['file'].name
+    mime_type = request.FILES['file'].content_type
+    filedata = request.FILES['file'].read()
+
+    content_loc = StaticContent.compute_location(org, course, filename)
+    content = StaticContent(content_loc, filename, mime_type, filedata)
+
+    # first let's see if a thumbnail can be created
+    (thumbnail_content, thumbnail_location) = contentstore().generate_thumbnail(content)
+
+    # delete cached thumbnail even if one couldn't be created this time (else the old thumbnail will continue to show)
+    del_cached_content(thumbnail_location)
+    # now store thumbnail location only if we could create it
+    if thumbnail_content is not None:
+        content.thumbnail_location = thumbnail_location
+
+    # then commit the content
+    contentstore().save(content)
+    del_cached_content(content.location)
+
+    # readback the saved content - we need the database timestamp
+    readback = contentstore().find(content.location)
+
+    response_payload = {'displayname': content.name,
+                        'uploadDate': get_default_time_display(readback.last_modified_at.timetuple()),
+                        'url': StaticContent.get_url_path_from_location(content.location),
+                        'thumb_url': StaticContent.get_url_path_from_location(thumbnail_location) if thumbnail_content is not None else None,
+                        'msg': 'Upload completed'
+                        }
+
+    response = HttpResponse(json.dumps(response_payload))
+    response['asset_url'] = StaticContent.get_url_path_from_location(content.location)
+    return response
+

cms/djangoapps/contentstore/views/checklist.py

+from django.http import HttpResponse, HttpResponseBadRequest
+from django.contrib.auth.decorators import login_required
+from django_future.csrf import ensure_csrf_cookie
+from access import get_location_and_verify_access
+from mitxmako.shortcuts import render_to_response
+from contentstore.utils import get_modulestore, get_url_reverse
+
+@ensure_csrf_cookie
+@login_required
+def get_checklists(request, org, course, name):
+    """
+    Send models, views, and html for displaying the course checklists.
+
+    org, course, name: Attributes of the Location for the item to edit
+    """
+    location = get_location_and_verify_access(request, org, course, name)
+
+    modulestore = get_modulestore(location)
+    course_module = modulestore.get_item(location)
+    new_course_template = Location('i4x', 'edx', 'templates', 'course', 'Empty')
+    template_module = modulestore.get_item(new_course_template)
+
+    # If course was created before checklists were introduced, copy them over from the template.
+    copied = False
+    if not course_module.checklists:
+        course_module.checklists = template_module.checklists
+        copied = True
+
+    checklists, modified = expand_checklist_action_urls(course_module)
+    if copied or modified:
+        modulestore.update_metadata(location, own_metadata(course_module))
+    return render_to_response('checklists.html',
+                              {
+                                  'context_course': course_module,
+                                  'checklists': checklists
+                              })
+
+
+@ensure_csrf_cookie
+@login_required
+def update_checklist(request, org, course, name, checklist_index=None):
+    """
+    restful CRUD operations on course checklists. The payload is a json rep of
+    the modified checklist. For PUT or POST requests, the index of the
+    checklist being modified must be included; the returned payload will
+    be just that one checklist. For GET requests, the returned payload
+    is a json representation of the list of all checklists.
+
+    org, course, name: Attributes of the Location for the item to edit
+    """
+    location = get_location_and_verify_access(request, org, course, name)
+    modulestore = get_modulestore(location)
+    course_module = modulestore.get_item(location)
+
+    real_method = get_request_method(request)
+    if real_method == 'POST' or real_method == 'PUT':
+        if checklist_index is not None and 0 <= int(checklist_index) < len(course_module.checklists):
+            index = int(checklist_index)
+            course_module.checklists[index] = json.loads(request.body)
+            checklists, modified = expand_checklist_action_urls(course_module)
+            modulestore.update_metadata(location, own_metadata(course_module))
+            return HttpResponse(json.dumps(checklists[index]), mimetype="application/json")
+        else:
+            return HttpResponseBadRequest(
+                "Could not save checklist state because the checklist index was out of range or unspecified.",
+                content_type="text/plain")
+    elif request.method == 'GET':
+        # In the JavaScript view initialize method, we do a fetch to get all the checklists.
+        checklists, modified = expand_checklist_action_urls(course_module)
+        if modified:
+            modulestore.update_metadata(location, own_metadata(course_module))
+        return HttpResponse(json.dumps(checklists), mimetype="application/json")
+    else:
+        return HttpResponseBadRequest("Unsupported request.", content_type="text/plain")
+
+
+def expand_checklist_action_urls(course_module):
+    """
+    Gets the checklists out of the course module and expands their action urls
+    if they have not yet been expanded.
+
+    Returns the checklists with modified urls, as well as a boolean
+    indicating whether or not the checklists were modified.
+    """
+    checklists = course_module.checklists
+    modified = False
+    for checklist in checklists:
+        if not checklist.get('action_urls_expanded', False):
+            for item in checklist.get('items'):
+                item['action_url'] = get_url_reverse(item.get('action_url'), course_module)
+            checklist['action_urls_expanded'] = True
+            modified = True
+
+    return checklists, modified
+
+
+
+

cms/djangoapps/contentstore/views/course.py

+from django.contrib.auth.decorators import login_required
+from django_future.csrf import ensure_csrf_cookie
+
+from util.json_request import expect_json
+from mitxmako.shortcuts import render_to_response
+
+@login_required
+@expect_json
+def create_new_course(request):
+
+    if settings.MITX_FEATURES.get('DISABLE_COURSE_CREATION', False) and not request.user.is_staff:
+        raise PermissionDenied()
+
+    # This logic is repeated in xmodule/modulestore/tests/factories.py
+    # so if you change anything here, you need to also change it there.
+    # TODO: write a test that creates two courses, one with the factory and
+    # the other with this method, then compare them to make sure they are
+    # equivalent.
+    template = Location(request.POST['template'])
+    org = request.POST.get('org')
+    number = request.POST.get('number')
+    display_name = request.POST.get('display_name')
+
+    try:
+        dest_location = Location('i4x', org, number, 'course', Location.clean(display_name))
+    except InvalidLocationError as e:
+        return HttpResponse(json.dumps({'ErrMsg': "Unable to create course '" + display_name + "'.\n\n" + e.message}))
+
+    # see if the course already exists
+    existing_course = None
+    try:
+        existing_course = modulestore('direct').get_item(dest_location)
+    except ItemNotFoundError:
+        pass
+
+    if existing_course is not None:
+        return HttpResponse(json.dumps({'ErrMsg': 'There is already a course defined with this name.'}))
+
+    course_search_location = ['i4x', dest_location.org, dest_location.course, 'course', None]
+    courses = modulestore().get_items(course_search_location)
+
+    if len(courses) > 0:
+        return HttpResponse(json.dumps({'ErrMsg': 'There is already a course defined with the same organization and course number.'}))
+
+    new_course = modulestore('direct').clone_item(template, dest_location)
+
+    # clone a default 'about' module as well
+
+    about_template_location = Location(['i4x', 'edx', 'templates', 'about', 'overview'])
+    dest_about_location = dest_location._replace(category='about', name='overview')
+    modulestore('direct').clone_item(about_template_location, dest_about_location)
+
+    if display_name is not None:
+        new_course.display_name = display_name
+
+    # set a default start date to now
+    new_course.start = time.gmtime()
+
+    initialize_course_tabs(new_course)
+
+    create_all_course_groups(request.user, new_course.location)
+
+    return HttpResponse(json.dumps({'id': new_course.location.url()}))
+
+
+def initialize_course_tabs(course):
+    # set up the default tabs
+    # I've added this because when we add static tabs, the LMS either expects a None for the tabs list or
+    # at least a list populated with the minimal times
+    # @TODO: I don't like the fact that the presentation tier is away of these data related constraints, let's find a better
+    # place for this. Also rather than using a simple list of dictionaries a nice class model would be helpful here
+
+    # This logic is repeated in xmodule/modulestore/tests/factories.py
+    # so if you change anything here, you need to also change it there.
+    course.tabs = [{"type": "courseware"},
+                   {"type": "course_info", "name": "Course Info"},
+                   {"type": "discussion", "name": "Discussion"},
+                   {"type": "wiki", "name": "Wiki"},
+                   {"type": "progress", "name": "Progress"}]
+
+    modulestore('direct').update_metadata(course.location.url(), own_metadata(course))
+
+
+@ensure_csrf_cookie
+@login_required
+def import_course(request, org, course, name):
+
+    location = get_location_and_verify_access(request, org, course, name)
+
+    if request.method == 'POST':
+        filename = request.FILES['course-data'].name
+
+        if not filename.endswith('.tar.gz'):
+            return HttpResponse(json.dumps({'ErrMsg': 'We only support uploading a .tar.gz file.'}))
+
+        data_root = path(settings.GITHUB_REPO_ROOT)
+
+        course_subdir = "{0}-{1}-{2}".format(org, course, name)
+        course_dir = data_root / course_subdir
+        if not course_dir.isdir():
+            os.mkdir(course_dir)
+
+        temp_filepath = course_dir / filename
+
+        logging.debug('importing course to {0}'.format(temp_filepath))
+
+        # stream out the uploaded files in chunks to disk
+        temp_file = open(temp_filepath, 'wb+')
+        for chunk in request.FILES['course-data'].chunks():
+            temp_file.write(chunk)
+        temp_file.close()
+
+        tf = tarfile.open(temp_filepath)
+        tf.extractall(course_dir + '/')
+
+        # find the 'course.xml' file
+
+        for r, d, f in os.walk(course_dir):
+            for files in f:
+                if files == 'course.xml':
+                    break
+            if files == 'course.xml':
+                break
+
+        if files != 'course.xml':
+            return HttpResponse(json.dumps({'ErrMsg': 'Could not find the course.xml file in the package.'}))
+
+        logging.debug('found course.xml at {0}'.format(r))
+
+        if r != course_dir:
+            for fname in os.listdir(r):
+                shutil.move(r / fname, course_dir)
+
+        module_store, course_items = import_from_xml(modulestore('direct'), settings.GITHUB_REPO_ROOT,
+                                                     [course_subdir], load_error_modules=False,
+                                                     static_content_store=contentstore(),
+                                                     target_location_namespace=Location(location),
+                                                     draft_store=modulestore())
+
+        # we can blow this away when we're done importing.
+        shutil.rmtree(course_dir)
+
+        logging.debug('new course at {0}'.format(course_items[0].location))
+
+        create_all_course_groups(request.user, course_items[0].location)
+
+        return HttpResponse(json.dumps({'Status': 'OK'}))
+    else:
+        course_module = modulestore().get_item(location)
+
+        return render_to_response('import.html', {
+            'context_course': course_module,
+            'active_tab': 'import',
+            'successful_import_redirect_url': get_url_reverse('CourseOutline', course_module)
+        })
+
+
+@ensure_csrf_cookie
+@login_required
+def generate_export_course(request, org, course, name):
+    location = get_location_and_verify_access(request, org, course, name)
+
+    loc = Location(location)
+    export_file = NamedTemporaryFile(prefix=name + '.', suffix=".tar.gz")
+
+    root_dir = path(mkdtemp())
+
+    # export out to a tempdir
+
+    logging.debug('root = {0}'.format(root_dir))
+
+    export_to_xml(modulestore('direct'), contentstore(), loc, root_dir, name, modulestore())
+    #filename = root_dir / name + '.tar.gz'
+
+    logging.debug('tar file being generated at {0}'.format(export_file.name))
+    tf = tarfile.open(name=export_file.name, mode='w:gz')
+    tf.add(root_dir / name, arcname=name)
+    tf.close()
+
+    # remove temp dir
+    shutil.rmtree(root_dir / name)
+
+    wrapper = FileWrapper(export_file)
+    response = HttpResponse(wrapper, content_type='application/x-tgz')
+    response['Content-Disposition'] = 'attachment; filename=%s' % os.path.basename(export_file.name)
+    response['Content-Length'] = os.path.getsize(export_file.name)
+    return response
+
+@ensure_csrf_cookie
+@login_required
+def export_course(request, org, course, name):
+
+    location = get_location_and_verify_access(request, org, course, name)
+
+    course_module = modulestore().get_item(location)
+
+    return render_to_response('export.html', {
+        'context_course': course_module,
+        'active_tab': 'export',
+        'successful_import_redirect_url': ''
+    })
+

cms/djangoapps/contentstore/views/error.py

+from django.http import HttpResponse, HttpResponseServerError, HttpResponseNotFound
+
+from mitxmako.shortcuts import render_to_string, render_to_response
+
+
+def not_found(request):
+    return render_to_response('error.html', {'error': '404'})
+
+
+def server_error(request):
+    return render_to_response('error.html', {'error': '500'})
+
+
+def render_404(request):
+    return HttpResponseNotFound(render_to_string('404.html', {}))
+
+
+def render_500(request):
+    return HttpResponseServerError(render_to_string('500.html', {}))
+
+

cms/djangoapps/contentstore/views/item.py

+from django.http import HttpResponse
+from django.contrib.auth.decorators import login_required
+from util.json_request import expect_json
+from mitxmako.shortcuts import render_to_response
+
+
+@login_required
+@expect_json
+def save_item(request):
+    item_location = request.POST['id']
+
+    # check permissions for this user within this course
+    if not has_access(request.user, item_location):
+        raise PermissionDenied()
+
+    store = get_modulestore(Location(item_location))
+
+    if request.POST.get('data') is not None:
+        data = request.POST['data']
+        store.update_item(item_location, data)
+
+    # cdodge: note calling request.POST.get('children') will return None if children is an empty array
+    # so it lead to a bug whereby the last component to be deleted in the UI was not actually
+    # deleting the children object from the children collection
+    if 'children' in request.POST and request.POST['children'] is not None:
+        children = request.POST['children']
+        store.update_children(item_location, children)
+
+    # cdodge: also commit any metadata which might have been passed along in the
+    # POST from the client, if it is there
+    # NOTE, that the postback is not the complete metadata, as there's system metadata which is
+    # not presented to the end-user for editing. So let's fetch the original and
+    # 'apply' the submitted metadata, so we don't end up deleting system metadata
+    if request.POST.get('metadata') is not None:
+        posted_metadata = request.POST['metadata']
+        # fetch original
+        existing_item = modulestore().get_item(item_location)
+
+        # update existing metadata with submitted metadata (which can be partial)
+        # IMPORTANT NOTE: if the client passed pack 'null' (None) for a piece of metadata that means 'remove it'
+        for metadata_key, value in posted_metadata.items():
+
+            if posted_metadata[metadata_key] is None:
+                # remove both from passed in collection as well as the collection read in from the modulestore
+                if metadata_key in existing_item._model_data:
+                    del existing_item._model_data[metadata_key]
+                del posted_metadata[metadata_key]
+            else:
+                existing_item._model_data[metadata_key] = value
+
+        # commit to datastore
+        # TODO (cpennington): This really shouldn't have to do this much reaching in to get the metadata
+        store.update_metadata(item_location, own_metadata(existing_item))
+
+    return HttpResponse()
+
+
+@login_required
+@expect_json
+def clone_item(request):
+    parent_location = Location(request.POST['parent_location'])
+    template = Location(request.POST['template'])
+
+    display_name = request.POST.get('display_name')
+
+    if not has_access(request.user, parent_location):
+        raise PermissionDenied()
+
+    parent = get_modulestore(template).get_item(parent_location)
+    dest_location = parent_location._replace(category=template.category, name=uuid4().hex)
+
+    new_item = get_modulestore(template).clone_item(template, dest_location)
+
+    # replace the display name with an optional parameter passed in from the caller
+    if display_name is not None:
+        new_item.display_name = display_name
+
+    get_modulestore(template).update_metadata(new_item.location.url(), own_metadata(new_item))
+
+    if new_item.location.category not in DETACHED_CATEGORIES:
+        get_modulestore(parent.location).update_children(parent_location, parent.children + [new_item.location.url()])
+
+    return HttpResponse(json.dumps({'id': dest_location.url()}))
+
+
+@login_required
+@expect_json
+def delete_item(request):
+    item_location = request.POST['id']
+    item_loc = Location(item_location)
+
+    # check permissions for this user within this course
+    if not has_access(request.user, item_location):
+        raise PermissionDenied()
+
+    # optional parameter to delete all children (default False)
+    delete_children = request.POST.get('delete_children', False)
+    delete_all_versions = request.POST.get('delete_all_versions', False)
+
+    store = modulestore()
+
+    item = store.get_item(item_location)
+
+    if delete_children:
+        _xmodule_recurse(item, lambda i: store.delete_item(i.location, delete_all_versions))
+    else:
+        store.delete_item(item.location, delete_all_versions)
+
+    # cdodge: we need to remove our parent's pointer to us so that it is no longer dangling
+    if delete_all_versions:
+        parent_locs = modulestore('direct').get_parent_locations(item_loc, None)
+
+        for parent_loc in parent_locs:
+            parent = modulestore('direct').get_item(parent_loc)
+            item_url = item_loc.url()
+            if item_url in parent.children:
+                children = parent.children
+                children.remove(item_url)
+                parent.children = children
+                modulestore('direct').update_children(parent.location, parent.children)
+
+    return HttpResponse()
+

cms/djangoapps/contentstore/views/preview.py

+from django.contrib.auth.decorators import login_required
+from xblock.runtime import DbModel
+from xmodule.x_module import ModuleSystem
+from xmodule.modulestore.mongo import MongoUsage
+from xmodule_modifiers import wrap_xmodule
+from session_kv_store import SessionKeyValueStore
+from requests import render_from_lms
+from functools import partial
+
+@login_required
+def preview_dispatch(request, preview_id, location, dispatch=None):
+    """
+    Dispatch an AJAX action to a preview XModule
+
+    Expects a POST request, and passes the arguments to the module
+
+    preview_id (str): An identifier specifying which preview this module is used for
+    location: The Location of the module to dispatch to
+    dispatch: The action to execute
+    """
+
+    descriptor = modulestore().get_item(location)
+    instance = load_preview_module(request, preview_id, descriptor)
+    # Let the module handle the AJAX
+    try:
+        ajax_return = instance.handle_ajax(dispatch, request.POST)
+
+    except NotFoundError:
+        log.exception("Module indicating to user that request doesn't exist")
+        raise Http404
+
+    except ProcessingError:
+        log.warning("Module raised an error while processing AJAX request",
+                    exc_info=True)
+        return HttpResponseBadRequest()
+
+    except:
+        log.exception("error processing ajax call")
+        raise
+
+    return HttpResponse(ajax_return)
+
+@login_required
+def preview_component(request, location):
+    # TODO (vshnayder): change name from id to location in coffee+html as well.
+    if not has_access(request.user, location):
+        raise HttpResponseForbidden()
+
+    component = modulestore().get_item(location)
+
+    return render_to_response('component.html', {
+        'preview': get_module_previews(request, component)[0],
+        'editor': wrap_xmodule(component.get_html, component, 'xmodule_edit.html')(),
+    })
+
+
+
+def preview_module_system(request, preview_id, descriptor):
+    """
+    Returns a ModuleSystem for the specified descriptor that is specialized for
+    rendering module previews.
+
+    request: The active django request
+    preview_id (str): An identifier specifying which preview this module is used for
+    descriptor: An XModuleDescriptor
+    """
+
+    def preview_model_data(descriptor):
+        return DbModel(
+            SessionKeyValueStore(request, descriptor._model_data),
+            descriptor.module_class,
+            preview_id,
+            MongoUsage(preview_id, descriptor.location.url()),
+        )
+
+    return ModuleSystem(
+        ajax_url=reverse('preview_dispatch', args=[preview_id, descriptor.location.url(), '']).rstrip('/'),
+        # TODO (cpennington): Do we want to track how instructors are using the preview problems?
+        track_function=lambda type, event: None,
+        filestore=descriptor.system.resources_fs,
+        get_module=partial(get_preview_module, request, preview_id),
+        render_template=render_from_lms,
+        debug=True,
+        replace_urls=partial(static_replace.replace_static_urls, data_directory=None, course_namespace=descriptor.location),
+        user=request.user,
+        xblock_model_data=preview_model_data,
+    )
+
+def get_preview_module(request, preview_id, descriptor):
+    """
+    Returns a preview XModule at the specified location. The preview_data is chosen arbitrarily
+    from the set of preview data for the descriptor specified by Location
+
+    request: The active django request
+    preview_id (str): An identifier specifying which preview this module is used for
+    location: A Location
+    """
+
+    return load_preview_module(request, preview_id, descriptor)
+
+
+def load_preview_module(request, preview_id, descriptor):
+    """
+    Return a preview XModule instantiated from the supplied descriptor, instance_state, and shared_state
+
+    request: The active django request
+    preview_id (str): An identifier specifying which preview this module is used for
+    descriptor: An XModuleDescriptor
+    instance_state: An instance state string
+    shared_state: A shared state string
+    """
+    system = preview_module_system(request, preview_id, descriptor)
+    try:
+        module = descriptor.xmodule(system)
+    except:
+        log.debug("Unable to load preview module", exc_info=True)
+        module = ErrorDescriptor.from_descriptor(
+            descriptor,
+            error_msg=exc_info_to_str(sys.exc_info())
+        ).xmodule(system)
+
+    # cdodge: Special case
+    if module.location.category == 'static_tab':
+        module.get_html = wrap_xmodule(
+            module.get_html,
+            module,
+            "xmodule_tab_display.html",
+        )
+    else:
+        module.get_html = wrap_xmodule(
+            module.get_html,
+            module,
+            "xmodule_display.html",
+        )
+
+    module.get_html = replace_static_urls(
+        module.get_html,
+        getattr(module, 'data_dir', module.location.course),
+        course_namespace=Location([module.location.tag, module.location.org, module.location.course, None, None])
+    )
+
+    return module
+
+def get_module_previews(request, descriptor):
+    """
+    Returns a list of preview XModule html contents. One preview is returned for each
+    pair of states returned by get_sample_state() for the supplied descriptor.
+
+    descriptor: An XModuleDescriptor
+    """
+    preview_html = []
+    for idx, (instance_state, shared_state) in enumerate(descriptor.get_sample_state()):
+        module = load_preview_module(request, str(idx), descriptor)
+        preview_html.append(module.get_html())
+    return preview_html
+

cms/djangoapps/contentstore/views/public.py

+from external_auth.views import ssl_login_shortcut
+from mitxmako.shortcuts import render_to_response
+from django_future.csrf import ensure_csrf_cookie
+from requests import index
+
+"""
+Public views
+"""
+
+@ensure_csrf_cookie
+def signup(request):
+    """
+    Display the signup form.
+    """
+    csrf_token = csrf(request)['csrf_token']
+    return render_to_response('signup.html', {'csrf': csrf_token})
+
+
+def old_login_redirect(request):
+    '''
+    Redirect to the active login url.
+    '''
+    return redirect('login', permanent=True)
+
+
+@ssl_login_shortcut
+@ensure_csrf_cookie
+def login_page(request):
+    """
+    Display the login form.
+    """
+    csrf_token = csrf(request)['csrf_token']
+    return render_to_response('login.html', {
+        'csrf': csrf_token,
+        'forgot_password_link': "//{base}/#forgot-password-modal".format(base=settings.LMS_BASE),
+    })
+
+
+def howitworks(request):
+    if request.user.is_authenticated():
+        return index(request)
+    else:
+        return render_to_response('howitworks.html', {})
+
+def ux_alerts(request):
+    """
+    static/proof-of-concept views
+    """
+    return render_to_response('ux-alerts.html', {})
+

cms/djangoapps/contentstore/views/requests.py

+from django.contrib.auth.decorators import login_required
+from django_future.csrf import ensure_csrf_cookie
+from mitxmako.shortcuts import render_to_response
+from xmodule.modulestore import Location
+from xmodule.modulestore.django import modulestore
+from access import has_access
+from contentstore.utils import get_url_reverse, get_lms_link_for_item
+from django.conf import settings
+
+@login_required
+@ensure_csrf_cookie
+def index(request):
+    """
+    List all courses available to the logged in user
+    """
+    courses = modulestore('direct').get_items(['i4x', None, None, 'course', None])
+
+    # filter out courses that we don't have access too
+    def course_filter(course):
+        return (has_access(request.user, course.location)
+                and course.location.course != 'templates'
+                and course.location.org != ''
+                and course.location.course != ''
+                and course.location.name != '')
+    courses = filter(course_filter, courses)
+
+    return render_to_response('index.html', {
+        'new_course_template': Location('i4x', 'edx', 'templates', 'course', 'Empty'),
+        'courses': [(course.display_name,
+                    get_url_reverse('CourseOutline', course),
+                    get_lms_link_for_item(course.location, course_id=course.location.course_id))
+                    for course in courses],
+        'user': request.user,
+        'disable_course_creation': settings.MITX_FEATURES.get('DISABLE_COURSE_CREATION', False) and not request.user.is_staff
+    })
+
+
+# ==== Views with per-item permissions================================
+
+
+# points to the temporary course landing page with log in and sign up
+def landing(request, org, course, coursename):
+    return render_to_response('temp-course-landing.html', {})
+
+# points to the temporary edge page
+def edge(request):
+    return render_to_response('university_profiles/edge.html', {})
+
+
+def event(request):
+    '''
+    A noop to swallow the analytics call so that cms methods don't spook and poor developers looking at
+    console logs don't get distracted :-)
+    '''
+    return HttpResponse(True)
+
+
+def get_request_method(request):
+    """
+    Using HTTP_X_HTTP_METHOD_OVERRIDE, in the request metadata, determine
+    what type of request came from the client, and return it.
+    """
+    # NB: we're setting Backbone.emulateHTTP to true on the client so everything comes as a post!!!
+    if request.method == 'POST' and 'HTTP_X_HTTP_METHOD_OVERRIDE' in request.META:
+        real_method = request.META['HTTP_X_HTTP_METHOD_OVERRIDE']
+    else:
+        real_method = request.method
+
+    return real_method
+
+def create_json_response(errmsg=None):
+    if errmsg is not None:
+        resp = HttpResponse(json.dumps({'Status': 'Failed', 'ErrMsg': errmsg}))
+    else:
+        resp = HttpResponse(json.dumps({'Status': 'OK'}))
+
+    return resp
+
+def render_from_lms(template_name, dictionary, context=None, namespace='main'):
+    """
+    Render a template using the LMS MAKO_TEMPLATES
+    """
+    return render_to_string(template_name, dictionary, context, namespace="lms." + namespace)
+
+
+def _xmodule_recurse(item, action):
+    for child in item.get_children():
+        _xmodule_recurse(child, action)
+
+    action(item)
+

cms/djangoapps/contentstore/views/session_kv_store.py

+from xblock.runtime import KeyValueStore
+
+class SessionKeyValueStore(KeyValueStore):
+    def __init__(self, request, model_data):
+        self._model_data = model_data
+        self._session = request.session
+
+    def get(self, key):
+        try:
+            return self._model_data[key.field_name]
+        except (KeyError, InvalidScopeError):
+            return self._session[tuple(key)]
+
+    def set(self, key, value):
+        try:
+            self._model_data[key.field_name] = value
+        except (KeyError, InvalidScopeError):
+            self._session[tuple(key)] = value
+
+    def delete(self, key):
+        try:
+            del self._model_data[key.field_name]
+        except (KeyError, InvalidScopeError):
+            del self._session[tuple(key)]
+
+    def has(self, key):
+        return key in self._model_data or key in self._session

cms/djangoapps/contentstore/views/user.py

+from django.contrib.auth.decorators import login_required
+from django_future.csrf import ensure_csrf_cookie
+
+from util.json_request import expect_json
+from mitxmako.shortcuts import render_to_response
+
+def user_author_string(user):
+    '''Get an author string for commits by this user.  Format:
+    first last <email@email.com>.
+
+    If the first and last names are blank, uses the username instead.
+    Assumes that the email is not blank.
+    '''
+    f = user.first_name
+    l = user.last_name
+    if f == '' and l == '':
+        f = user.username
+    return '{first} {last} <{email}>'.format(first=f,
+                                             last=l,
+                                             email=user.email)
+
+
+@login_required
+@ensure_csrf_cookie
+def manage_users(request, location):
+    '''
+    This view will return all CMS users who are editors for the specified course
+    '''
+    # check that logged in user has permissions to this item
+    if not has_access(request.user, location, role=INSTRUCTOR_ROLE_NAME) and not has_access(request.user, location, role=STAFF_ROLE_NAME):
+        raise PermissionDenied()
+
+    course_module = modulestore().get_item(location)
+
+    return render_to_response('manage_users.html', {
+        'active_tab': 'users',
+        'context_course': course_module,
+        'staff': get_users_in_course_group_by_role(location, STAFF_ROLE_NAME),
+        'add_user_postback_url': reverse('add_user', args=[location]).rstrip('/'),
+        'remove_user_postback_url': reverse('remove_user', args=[location]).rstrip('/'),
+        'allow_actions': has_access(request.user, location, role=INSTRUCTOR_ROLE_NAME),
+        'request_user_id': request.user.id
+    })
+
+
+
+
+@expect_json
+@login_required
+@ensure_csrf_cookie
+def add_user(request, location):
+    '''
+    This POST-back view will add a user - specified by email - to the list of editors for
+    the specified course
+    '''
+    email = request.POST["email"]
+
+    if email == '':
+        return create_json_response('Please specify an email address.')
+
+    # check that logged in user has admin permissions to this course
+    if not has_access(request.user, location, role=INSTRUCTOR_ROLE_NAME):
+        raise PermissionDenied()
+
+    user = get_user_by_email(email)
+
+    # user doesn't exist?!? Return error.
+    if user is None:
+        return create_json_response('Could not find user by email address \'{0}\'.'.format(email))
+
+    # user exists, but hasn't activated account?!?
+    if not user.is_active:
+        return create_json_response('User {0} has registered but has not yet activated his/her account.'.format(email))
+
+    # ok, we're cool to add to the course group
+    add_user_to_course_group(request.user, user, location, STAFF_ROLE_NAME)
+
+    return create_json_response()
+
+
+@expect_json
+@login_required
+@ensure_csrf_cookie
+def remove_user(request, location):
+    '''
+    This POST-back view will remove a user - specified by email - from the list of editors for
+    the specified course
+    '''
+
+    email = request.POST["email"]
+
+    # check that logged in user has admin permissions on this course
+    if not has_access(request.user, location, role=INSTRUCTOR_ROLE_NAME):
+        raise PermissionDenied()
+
+    user = get_user_by_email(email)
+    if user is None:
+        return create_json_response('Could not find user by email address \'{0}\'.'.format(email))
+
+    # make sure we're not removing ourselves
+    if user.id == request.user.id:
+        raise PermissionDenied()
+
+    remove_user_from_course_group(request.user, user, location, STAFF_ROLE_NAME)
+
+    return create_json_response()
+