From b7d7d5cc83442b5e424cd614385a3126dd2de6d2 Mon Sep 17 00:00:00 2001
From: Sander Roosendaal <roosendaalsander@gmail.com>
Date: Wed, 17 May 2017 09:31:56 +0200
Subject: [PATCH] redirects to boxchart workout picker when ids messed up

---
 rowers/dataprep.py |  9 +++++++++
 rowers/views.py    | 13 ++++++++++++-
 2 files changed, 21 insertions(+), 1 deletion(-)

diff --git a/rowers/dataprep.py b/rowers/dataprep.py
index eeaa2b64..e25bc255 100644
--- a/rowers/dataprep.py
+++ b/rowers/dataprep.py
@@ -95,6 +95,15 @@ from scipy.signal import savgol_filter
 
 import datetime
 
+def get_workouts(ids,userid):
+    workouts = []
+    for id in ids:
+        w = Workout.objects.get(id=id)
+        if w.user.user.id == userid:
+            workouts.append[w]
+
+    return workouts
+
 def filter_df(datadf,fieldname,value,largerthan=True):
 
     try:
diff --git a/rowers/views.py b/rowers/views.py
index fb8ce778..7e6461b8 100644
--- a/rowers/views.py
+++ b/rowers/views.py
@@ -3124,7 +3124,18 @@ def boxplot_view(request,userid=0,
             workstrokesonly = not includereststrokes
             ids = request.session['ids']
             request.session['ids'] = ids
-            workouts = [Workout.objects.get(id=id) for id in ids]
+            workouts = dataprep.get_workouts(ids,userid)
+            if not workouts:
+                message = 'Error: Workouts in session storage do not belong to this user.'
+                messages.error(request,message)
+                url = reverse(user_boxplot_select,
+                              kwargs={
+                                  'userid':userid,
+                                  }
+                              )
+                return HttpResponseRedirect(url)
+                              
+            # workouts = [Workout.objects.get(id=id) for id in ids]
 
             labeldict = {
                 int(w.id): w.__unicode__() for w in workouts