Allocation logic fix (#97)

* handle mess time feedbackk

* update mess-card

* handling errors

* update

* Fixed allocation limit logic

* Fix code scanning alert no. 11: URL redirection from remote source

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

---------

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

home/views.py

@@ -6,6 +6,7 @@
 from django.contrib.auth.decorators import login_required
 from django.http import JsonResponse
 from django.shortcuts import redirect, render
+from django.utils.http import url_has_allowed_host_and_scheme
 from django.utils.dateparse import parse_date
 from django.utils.timezone import now
 
@@ -354,94 +355,62 @@ def allocationForm(request):
 
     :template:`home/allocationForm.html`
 
-    Gets the data from the allocation form , and adds it to the coresponding allocation model
+    Gets the data from the allocation form, and adds it to the corresponding allocation model
     """
     caterer_list = Caterer.objects.filter(visible=True).all()
     alloc_form = AllocationForm.objects.filter(active=True).last()
-    try:
-        if not alloc_form:
-            raise Exception("Form is closed for now")
+    text = ""
+    message = ""
+
+    if not alloc_form:
+        message = "Form is closed for now"
+    else:
         student = Student.objects.filter(email__iexact=str(request.user.email)).last()
         if not student:
-            raise Exception(
-                "Signed in account can not fill the allocation form. Please inform the dining Office to add your email ID to the database"
-            )
-        text = ""
-        message = ""
-        if (alloc_form.start_time and alloc_form.start_time > now()) or (
+            message = "Signed in account cannot fill the allocation form. Please inform the dining Office to add your email ID to the database"
+        elif (alloc_form.start_time and alloc_form.start_time > now()) or (
             alloc_form.end_time and alloc_form.end_time < now()
         ):
-            raise Exception("The Form is closed for now")
-        elif Allocation.objects.filter(
-            email=student, period=alloc_form.period
-        ).exists():
-            raise Exception(
-                "You have filled the form for this period. Please visit the profile page after the allocation process is completed to check your allocated caterer"
-            )
+            message = "The Form is closed for now"
+        elif Allocation.objects.filter(email=student, period=alloc_form.period).exists():
+            message = "You have filled the form for this period. Please visit the profile page after the allocation process is completed to check your allocated caterer"
         elif request.method == "POST" and request.user.is_authenticated:
             period_obj = alloc_form.period
-            high_tea = False
-            jain = request.POST["jain"]
-            # if jain == "True":
-            #     high_tea = False
-            if caterer_list.count() < 1:
-                first_pref = None
-            else:
-                first_pref = request.POST["first_pref"]
-                caterer1 = Caterer.objects.get(name=first_pref)
-            if caterer_list.count() < 2:
-                second_pref = None
-            else:
-                second_pref = request.POST["second_pref"]
-                caterer2 = Caterer.objects.get(name=second_pref)
-            if caterer_list.count() < 3:
-                third_pref = None
+            jain = request.POST["jain"] == "True"
+            caterer_prefs = [
+                request.POST.get(pref) for pref in ["first_pref", "second_pref", "third_pref"]
+            ]
+            caterer_prefs = [Caterer.objects.get(name=pref) for pref in caterer_prefs if pref]
+
+            caterer = next((c for c in caterer_prefs if c.student_limit > Allocation.objects.filter(caterer=c, period=period_obj).count()), None)
+            if caterer:
+                student_id = f"{caterer.name[0]}{'J' if jain else ''}{caterer.student_limit}"
+                allocation = Allocation(
+                    email=student,
+                    student_id=student_id,
+                    period=period_obj,
+                    caterer=caterer,
+                    high_tea=False,
+                    jain=jain,
+                    first_pref=caterer_prefs[0].name if caterer_prefs else None,
+                    second_pref=caterer_prefs[1].name if len(caterer_prefs) > 1 else None,
+                    third_pref=caterer_prefs[2].name if len(caterer_prefs) > 2 else None,
+                )
+                allocation.save()
+                UnregisteredStudent.objects.filter(email__iexact=student.email).delete()
+                text = "Allocation Form filled Successfully"
+                request.session["text"] = text
+                if url_has_allowed_host_and_scheme(request.path, allowed_hosts=None):
+                    return redirect(request.path)
+                else:
+                    return redirect('/')
             else:
-                third_pref = request.POST["third_pref"]
-                caterer3 = Caterer.objects.get(name=third_pref)
-            if caterer1.student_limit > 0:
-                caterer1.student_limit -= 1
-                caterer1.save(update_fields=["student_limit"])
-                caterer = caterer1
-            elif caterer2 and caterer2.student_limit > 0:
-                caterer2.student_limit -= 1
-                caterer2.save(update_fields=["student_limit"])
-                caterer = caterer2
-            elif caterer3 and caterer3.student_limit > 0:
-                caterer3.student_limit -= 1
-                caterer3.save(update_fields=["student_limit"])
-                caterer = caterer3
-            student_id = str(caterer.name[0])
-            # if high_tea == "True":
-            #     student_id += "H"
-            # else:
-            #     student_id+="NH"
-            if jain == "True":
-                student_id += "J"
-            student_id += str(caterer.student_limit)
-            allocation = Allocation(
-                email=student,
-                student_id=student_id,
-                period=period_obj,
-                caterer=caterer,
-                high_tea=high_tea,
-                jain=jain,
-                first_pref=first_pref,
-                second_pref=second_pref,
-                third_pref=third_pref,
-            )
-            allocation.save()
-            UnregisteredStudent.objects.filter(email__iexact=student.email).delete()
-            text = "Allocation Form filled Successfully"
-            request.session["text"] = text
-            return redirect(request.path)
-        text = request.session.get("text", "")
-        if text != "":
-            del request.session["text"]
-    except Exception as e:
-        logger.error(e)
-        message = e
-        text = ""
+                message = "No caterer available with sufficient student limit"
+
+    text = request.session.get("text", "")
+    if text:
+        del request.session["text"]
+
     context = {
         "text": text,
         "caterer_list": caterer_list,