--- a/taskapp/models.py	Fri Feb 26 17:49:26 2010 +0530
+++ b/taskapp/models.py	Fri Feb 26 18:34:30 2010 +0530
@@ -155,12 +155,15 @@
 
 class Notification(models.Model):
 
-    to = models.ManyToManyField(User, related_name = "%(class)s_to", blank = False)
-    is_read = models.BooleanField(default = False)
-    sent_date = models.DateTimeField()
+    sent_to = models.ManyToManyField(User, related_name = "%(class)s_sent_to", blank = False)
+    sent_from = models.ManyToManyField(User, related_name = "%(class)s_sent_from", blank = True)
+
     sub = models.CharField(max_length = 100)
     message = models.TextField()
-    deleted = models.BooleanField(default = False)
+
+    sent_date = models.DateTimeField()
+    is_read = models.BooleanField(default = False)
+    is_deleted = models.BooleanField(default = False)
     
 tagging.register(Profile)
 tagging.register(Task)

--- a/taskapp/utilities/notification.py	Fri Feb 26 17:49:26 2010 +0530
+++ b/taskapp/utilities/notification.py	Fri Feb 26 18:34:30 2010 +0530
@@ -1,5 +1,6 @@
+from datetime import datetime
+from django.contrib.auth.models import User
 from pytask.taskapp.models import Notification
-from datetime import datetime
 
 def create_notification(to,subject,message):
     """
@@ -10,7 +11,7 @@
     """
     notification = Notification(sent_date = datetime.now())
     notification.save()
-    notification.to = to
+    notification.sent_to = to
     notification.sub = subject
     notification.message = message
     notification.save()
@@ -39,6 +40,24 @@
         notification = Notification.objects.get(id = notification_id)
     except Notification.DoesNotExist:
         return False
-    notification.deleted = True
+    notification.is_deleted = True
     notification.save()
     return True
+
+def get_notification(nid, user):
+    """ if notification exists, and belongs to the current user, return it.
+    else return None.
+    """
+
+    try:
+        notify_obj = Notification.objects.get(id=nid)
+    except Notification.DoesNotExist:
+        return None
+
+    try:
+        notify_obj.sent_to.get(id=user.id)
+    except User.DoesNotExist:
+        return None
+
+    if not notify_obj.is_deleted:
+        return notify_obj

--- a/taskapp/views/user.py	Fri Feb 26 17:49:26 2010 +0530
+++ b/taskapp/views/user.py	Fri Feb 26 18:34:30 2010 +0530
@@ -6,10 +6,14 @@
 from django.contrib.auth.decorators import login_required
 
 from pytask.taskapp.models import Task, Profile, Request
+
 from pytask.taskapp.events.user import createUser, updateProfile
+from pytask.taskapp.events.request import reply_to_request
+
 from pytask.taskapp.forms.user import UserProfileEditForm
-from pytask.taskapp.events.request import reply_to_request
+
 from pytask.taskapp.utilities.request import get_request
+from pytask.taskapp.utilities.notification import get_notification
 
 def show_msg(user, message, redirect_url=None, url_desc=None):
     """ simply redirect to homepage """
@@ -40,7 +44,7 @@
         user_profile = user.get_profile()
         is_mentor = True if user.task_mentors.all() else False
         can_create_task = False if user_profile.rights == u"CT" else True
-        notifications = user.notification_to.filter(deleted=False,is_read=False)
+        notifications = user.notification_sent_to.filter(is_deleted=False,is_read=False)
         requests = user.request_sent_to.filter(is_replied=False)
         
         context = {'user':user,
@@ -168,9 +172,7 @@
 
     user = request.user
 
-    active_notifications = user.notification_to.filter(deleted=False).order_by('sent_date').reverse()
-    for pos, notification in enumerate(reversed(active_notifications)):
-        notification.pos = pos
+    active_notifications = user.notification_sent_to.filter(is_deleted=False).order_by('sent_date').reverse()
 
     context = {
         'user':user,
@@ -186,8 +188,10 @@
     """
 
     user = request.user
-    notifications = user.notification_to.filter(deleted=False).order_by('sent_date')
-    notification  = notifications[int(nid)]
+    notification = get_notification(nid, user)
+    if not notification:
+        raise Http404
+
     notification.is_read = True
     notification.save()
 
@@ -206,13 +210,16 @@
     """
 
     user = request.user
-    notifications = user.notification_to.filter(deleted=False).order_by('sent_date')
-    notification = notifications[int(nid)]
+    notification = get_notification(nid, user)
+
+    if not notification:
+        raise Http404
+
     notifications_url = "/user/notifications/"
 
     if request.method == "POST":
         if action == "delete":
-            notification.deleted = True
+            notification.is_deleted = True
         elif action == "unread":
             notification.is_read = False
         

--- a/templates/user/browse_notifications.html	Fri Feb 26 17:49:26 2010 +0530
+++ b/templates/user/browse_notifications.html	Fri Feb 26 18:34:30 2010 +0530
@@ -4,7 +4,7 @@
         You have no notifications.
     {% else %}
         {% for notification in notifications %}
-            <a href="/user/notifications/nid={{notification.pos}}">
+            <a href="/user/notifications/nid={{notification.id}}">
             {% if not notification.is_read %} <b> {% endif %}
             {{notification.sub}}
             {% if not notification.is_read %} </b> {% endif %}</a><br />