from django.shortcuts import render_to_response, get_object_or_404
from django.http import HttpResponseRedirect, Http404
from django.template import RequestContext
from django.core.urlresolvers import reverse
from django.utils.translation import ugettext_lazy as _
from django.contrib.auth.models import User
from django.contrib.auth.decorators import login_required
from django.views.generic import date_based

from blog.models import Post
from blog.forms import *
import datetime

try:
    from notification import models as notification
except ImportError:
    notification = None

def blogs(request):
    blogs = Post.objects.filter(status=2).order_by("-publish")
    return render_to_response("blog/blogs.html", {"blogs": blogs}, context_instance=RequestContext(request))
    
def post(request, username, year, month, slug):
    post = Post.objects.filter(slug=slug, publish__year=int(year), publish__month=int(month)).filter(author__username=username)
    if not post:
        raise Http404
    
    return render_to_response("blog/post.html", {
        "post": post[0]
    }, context_instance=RequestContext(request))

def your_posts(request):
    user = request.user
    blogs = Post.objects.filter(author=user)
    
    return render_to_response("blog/your_posts.html", {"blogs": blogs}, context_instance=RequestContext(request))

@login_required
def new(request):
    if request.user.is_authenticated() and request.method == "POST":
        if request.POST["action"] == "create":
            blog_form = BlogForm(request.POST)
            if blog_form.is_valid():
                blog = blog_form.save(commit=False)
                blog.author = request.user
                blog.creator_ip = request.META['REMOTE_ADDR']
                blog.save()
                request.user.message_set.create(message="Successfully saved post '%s'" % blog.title)
                
                return HttpResponseRedirect(reverse("your_posts"))
        else:
            blog_form = BlogForm()
    else:
        blog_form = BlogForm()
    
    return render_to_response("blog/new.html", {
                        "blog_form": blog_form,
                        }, context_instance=RequestContext(request))

def edit(request, id):
    if request.user.is_authenticated() and request.method == "POST":
        post = get_object_or_404(Post, id=id)
        if request.POST["action"] == "update":
            blog_form = BlogForm(request.POST, instance=post)
            if blog_form.is_valid():
                blog = blog_form.save(commit=False)
                blog.save()
                request.user.message_set.create(message="Successfully updated post '%s'" % blog.title)
            
                return HttpResponseRedirect(reverse("your_posts"))
        else:
            blog_form = BlogForm(instance=post)
    else:
        post = get_object_or_404(Post, id=id)
        if post.author == request.user:
            is_author = True
        else:
            is_author = False
    
    blog_form = BlogForm(instance=post)
    
    return render_to_response("blog/edit.html", {"is_author": is_author, "blog_form": blog_form}, context_instance=RequestContext(request))

@@ -1378,44 +1378,8 @@
  if 
-request.user.is_authenticated() and 
 requ
@@ -2159,24 +2159,40 @@
 (request))%0A%0A
+@login_required%0A
 def edit(req
@@ -2213,44 +2213,8 @@
  if 
-request.user.is_authenticated() and 
 requ
@@ -2273,32 +2273,229 @@
 04(Post, id=id)%0A
+        if post.author != request.user:%0A            request.user.message_set.create(message=%22You can't edit posts that aren't yours%22)%0A            return HttpResponseRedirect(reverse(%22your_posts%22))%0A
         if reque

Verify that the user is the post owner when editing blog posts, also a tiny bit of cleanup