From c6d84acbc67bdb67a415a26f5ce8fda3bdae9ee6 Mon Sep 17 00:00:00 2001
From: Davide Alberani <da@erlug.linux.it>
Date: Sat, 2 Dec 2017 17:32:51 +0100
Subject: [PATCH] fix #191: limit the amount of transferred data

---
 angular_app/events-list.html  | 2 +-
 angular_app/js/controllers.js | 6 ++++--
 eventman_server.py            | 9 ++++++---
 3 files changed, 11 insertions(+), 6 deletions(-)

diff --git a/angular_app/events-list.html b/angular_app/events-list.html
index bf1166a..f06a379 100644
--- a/angular_app/events-list.html
+++ b/angular_app/events-list.html
@@ -54,7 +54,7 @@
                             </div>
                         </td>
                         <td ng-if="hasPermission('event:tickets-all|read')" class="hcenter">
-                            <p><span ng-init="attendeesNr = ((event.tickets || []) | attendeesFilter).length">{{attendeesNr}}</span> / {{event.tickets_sold || 0}} ({{((attendeesNr / (event.tickets_sold || 0) * 100) || 0).toFixed()}}%)</p>
+                            <p><span ng-init="attendeesNr = event.total_attendees || 0">{{attendeesNr}}</span> / {{event.tickets_sold || 0}} ({{((attendeesNr / (event.tickets_sold || 0) * 100) || 0).toFixed()}}%)</p>
                         </td>
                         <td class="vtop">
                             <div ng-if="hasPermission('event:tickets-all|create')" class="top5 hcenter"><button ng-click="$state.go('event.ticket.new', {id: event._id})" ng-class="{min150: true, btn: true, 'btn-success': true, disabled: event.no_tickets_for_sale}" type="button" title="{{'Join this event' | translate}}"><span class="fa fa-user-plus vcenter"></span> {{'Join this event' | translate}}</button></div>
diff --git a/angular_app/js/controllers.js b/angular_app/js/controllers.js
index 1167263..60f205e 100644
--- a/angular_app/js/controllers.js
+++ b/angular_app/js/controllers.js
@@ -78,7 +78,7 @@ eventManControllers.controller('EventsListCtrl', ['$scope', 'Event', 'EventTicke
         $scope.filteredLength = 0;
         $scope.maxPaginationSize = 10;
 
-        $scope.events = Event.all(function(events) {
+        $scope.events = Event.all({_summary: true}, function(events) {
             if (events && $state.is('tickets')) {
                 angular.forEach(events, function(evt, idx) {
                     var evt_tickets = (evt.tickets || []).slice(0);
@@ -216,7 +216,9 @@ eventManControllers.controller('EventDetailsCtrl', ['$scope', '$state', 'Event',
         $scope.eventFormDisabled = false;
 
         if ($state.params.id) {
-            $scope.event = Event.get($state.params);
+            var params = angular.copy($state.params);
+            params['_summary'] = true;
+            $scope.event = Event.get(params);
             if ($state.is('event.view') || !$rootScope.hasPermission('event|update')) {
                 $scope.eventFormDisabled = true;
             }
diff --git a/eventman_server.py b/eventman_server.py
index 6d5640d..1bea9b9 100755
--- a/eventman_server.py
+++ b/eventman_server.py
@@ -430,7 +430,8 @@ class CollectionHandler(BaseHandler):
             permission = '%s|read' % self.collection
             if acl and not self.has_permission(permission):
                 return self.build_error(status=401, message='insufficient permissions: %s' % permission)
-            output = {self.collection: self.db.query(self.collection, self.arguments)}
+            db_query = {k: v for k, v in self.arguments.items() if not k.startswith('_')}
+            output = {self.collection: self.db.query(self.collection, db_query)}
             output = self.apply_filter(output, 'get_all')
             self.write(output)
 
@@ -625,7 +626,9 @@ class EventsHandler(CollectionHandler):
     def _mangle_event(self, event):
         # Some in-place changes to an event
         if 'tickets' in event:
-            event['tickets_sold'] = len([t for t in event['tickets'] if not t.get('cancelled')])
+            valid_tickets = [t for t in event['tickets'] if not t.get('cancelled')]
+            event['tickets_sold'] = len(valid_tickets)
+            event['total_attendees'] = len([t for t in valid_tickets if t.get('attended')])
             event['no_tickets_for_sale'] = False
             try:
                 self._check_sales_datetime(event)
@@ -634,7 +637,7 @@ class EventsHandler(CollectionHandler):
                 event['no_tickets_for_sale'] = True
             if not self.has_permission('event|write'):
                 event['group_id'] = ''
-            if not self.has_permission('tickets-all|read'):
+            if '_summary' in self.arguments or not self.has_permission('tickets-all|read'):
                 event['tickets'] = []
         return event