- Add some more analytics events

- Enable business features for personal users on business plans
- Fix a bug in the credit card image view

endpoints/web.py

@@ -4,7 +4,7 @@ import stripe
 
 from flask import (abort, redirect, request, url_for, render_template,
                    make_response, Response)
-from flask.ext.login import login_user, UserMixin
+from flask.ext.login import login_user, UserMixin, current_user
 from flask.ext.principal import identity_changed
 from urlparse import urlparse
 
@@ -134,21 +134,34 @@ def privacy():
 
 @app.route('/receipt', methods=['GET'])
 def receipt():
+  if not current_user.is_authenticated():
+    abort(401)
+    return
+
   id =  request.args.get('id')
   if id:
     invoice = stripe.Invoice.retrieve(id)
     if invoice:
-      org = model.get_user_or_org_by_customer_id(invoice.customer)
-      if org and org.organization:
-        admin_org = AdministerOrganizationPermission(org.username)
-        if admin_org.can():
-          file_data = renderInvoiceToPdf(invoice, org)          
-          return Response(file_data,
-                          mimetype="application/pdf",
-                          headers={"Content-Disposition":
-                                     "attachment;filename=receipt.pdf"})
+      user_or_org = model.get_user_or_org_by_customer_id(invoice.customer)
+      
+      if user_or_org:
+        if user_or_org.organization:
+          admin_org = AdministerOrganizationPermission(user_or_org.username)
+          if not admin_org.can():
+            abort(404)
+            return
+        else:
+          if not user_or_org.username == current_user.db_user().username:
+            abort(404)
+            return      
+
+      file_data = renderInvoiceToPdf(invoice, user_or_org)          
+      return Response(file_data,
+                      mimetype="application/pdf",
+                      headers={"Content-Disposition": "attachment;filename=receipt.pdf"})
   abort(404)
 
+
 def common_login(db_user):
   if login_user(_LoginWrappedDBUser(db_user.username, db_user)):
     logger.debug('Successfully signed in as: %s' % db_user.username)