--- a/taskapp/utilities/request.py	Fri Feb 26 16:17:45 2010 +0530
+++ b/taskapp/utilities/request.py	Fri Feb 26 17:49:26 2010 +0530
@@ -1,4 +1,5 @@
 from datetime import datetime
+
 from django.contrib.auth.models import User
 from pytask.taskapp.models import Request, Profile
 
@@ -29,3 +30,21 @@
         req.sent_to.add(sent_to)
     req.save()
 
+def get_request(rid, user):
+    """ see if the request is replied or if he can not view the request,
+    raise 404 error. else return request.
+    """
+
+    try:
+        request_obj = Request.objects.get(id=rid)
+    except Request.DoesNotExist:
+        return None
+
+    if request_obj.is_replied == True:
+        return None
+    else:
+        try:
+            request_obj.sent_to.get(id=user.id)
+        except User.DoesNotExist:
+            return None
+        return request_obj

--- a/taskapp/views/user.py	Fri Feb 26 16:17:45 2010 +0530
+++ b/taskapp/views/user.py	Fri Feb 26 17:49:26 2010 +0530
@@ -9,6 +9,7 @@
 from pytask.taskapp.events.user import createUser, updateProfile
 from pytask.taskapp.forms.user import UserProfileEditForm
 from pytask.taskapp.events.request import reply_to_request
+from pytask.taskapp.utilities.request import get_request
 
 def show_msg(user, message, redirect_url=None, url_desc=None):
     """ simply redirect to homepage """
@@ -104,10 +105,9 @@
 def browse_requests(request):
     
     user = request.user
-    active_reqs = user.request_sent_to.filter(is_replied=False)
+    active_reqs = user.request_sent_to.filter(is_replied=False).exclude(is_valid=False)
     reqs = active_reqs.order_by('creation_date').reverse()
-    for pos, req in enumerate(reversed(reqs)):
-        req.pos = pos
+
     context = {
         'user':user,
         'reqs':reqs,
@@ -122,8 +122,10 @@
     """
 
     user = request.user
-    reqs = user.request_sent_to.filter(is_replied=False).order_by('creation_date')
-    user_request = reqs[int(rid)]
+    user_request = get_request(rid, user)
+    if not user_request:
+        raise Http404
+
     user_request.is_read = True
     user_request.save()
 
@@ -142,11 +144,13 @@
     """
 
     user = request.user
+    browse_request_url= '/user/requests'
+    req_obj = get_request(rid, user)
+
+    if not req_obj:
+        return show_msg(user, "Your reply has been processed", browse_request_url, "view other requests")
 
     if request.method=="POST":
-        browse_request_url= '/user/requests'
-        reqs = user.request_sent_to.filter(is_replied=False).order_by('creation_date')
-        req_obj = reqs[int(rid)]
         reply = True if reply == "yes" else False
         req_obj.remarks = request.POST.get('remarks', "")
         req_obj.save()

--- a/templates/user/browse_requests.html	Fri Feb 26 16:17:45 2010 +0530
+++ b/templates/user/browse_requests.html	Fri Feb 26 17:49:26 2010 +0530
@@ -4,7 +4,7 @@
         You have no unreplied requests.
     {% else %}
         {% for req in reqs %}
-            <form><a href="/user/requests/rid={{req.pos}}">
+            <form><a href="/user/requests/rid={{req.id}}">
             {% if not req.is_read %}<b>{% endif %}{{req.sent_by.username}}|{{req.role}}|
             {% ifequal req.role "PY" %}            
                 {{req.task.title}}