From f29054558ae4fe245728af5dcda8b425c5a49ecd Mon Sep 17 00:00:00 2001
From: Yohann D'ANELLO <ynerant@crans.org>
Date: Mon, 27 Sep 2021 14:30:47 +0200
Subject: [PATCH 1/2] Fix note render with formattable aliases

Signed-off-by: Yohann D'ANELLO <ynerant@crans.org>
---
 apps/activity/tables.py | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/apps/activity/tables.py b/apps/activity/tables.py
index a3189a79..2d8e5dcc 100644
--- a/apps/activity/tables.py
+++ b/apps/activity/tables.py
@@ -1,7 +1,9 @@
 # Copyright (C) 2018-2021 by BDE ENS Paris-Saclay
 # SPDX-License-Identifier: GPL-3.0-or-later
+
 from django.utils import timezone
-from django.utils.html import format_html
+from django.utils.html import escape
+from django.utils.safestring import mark_safe
 from django.utils.translation import gettext_lazy as _
 import django_tables2 as tables
 from django_tables2 import A
@@ -52,8 +54,8 @@ class GuestTable(tables.Table):
     def render_entry(self, record):
         if record.has_entry:
             return str(_("Entered on ") + str(_("{:%Y-%m-%d %H:%M:%S}").format(record.entry.time, )))
-        return format_html('<button id="{id}" class="btn btn-danger btn-sm" onclick="remove_guest(this.id)"> '
-                           '{delete_trans}</button>'.format(id=record.id, delete_trans=_("remove").capitalize()))
+        return mark_safe('<button id="{id}" class="btn btn-danger btn-sm" onclick="remove_guest(this.id)"> '
+                         '{delete_trans}</button>'.format(id=record.id, delete_trans=_("remove").capitalize()))
 
 
 def get_row_class(record):
@@ -91,7 +93,7 @@ class EntryTable(tables.Table):
         if hasattr(record, 'username'):
             username = record.username
             if username != value:
-                return format_html(value + " <em>aka.</em> " + username)
+                return mark_safe(escape(value) + " <em>aka.</em> " + escape(username))
         return value
 
     def render_balance(self, value):

From 69b3d2ac9c1448015db67625208dbb5f91bf5529 Mon Sep 17 00:00:00 2001
From: Yohann D'ANELLO <ynerant@crans.org>
Date: Mon, 27 Sep 2021 14:51:17 +0200
Subject: [PATCH 2/2] [activity] Fix button shortcut to entries page

Signed-off-by: Yohann D'ANELLO <ynerant@crans.org>
---
 .../note/templates/note/transaction_form.html | 32 +++++++++++--------
 apps/note/views.py                            |  2 +-
 2 files changed, 19 insertions(+), 15 deletions(-)

diff --git a/apps/note/templates/note/transaction_form.html b/apps/note/templates/note/transaction_form.html
index dc5afbda..bdf047a5 100644
--- a/apps/note/templates/note/transaction_form.html
+++ b/apps/note/templates/note/transaction_form.html
@@ -10,21 +10,25 @@ SPDX-License-Identifier: GPL-2.0-or-later
 {# bandeau transfert/crédit/débit/activité #}
     <div class="row">
         <div class="col-xl-12">
-            <div class="btn-group btn-group-toggle btn-block" data-toggle="buttons">
-                <label for="type_transfer" class="btn btn-sm btn-outline-primary active">
-                    <input type="radio" name="transaction_type" id="type_transfer">
-                    {% trans "Transfer" %}
-                </label>
-                {% if "note.notespecial"|not_empty_model_list %}
-                    <label for="type_credit" class="btn btn-sm btn-outline-primary">
-                        <input type="radio" name="transaction_type" id="type_credit">
-                        {% trans "Credit" %}
+            <div class="btn-group btn-block">
+                <div class="btn-group btn-group-toggle btn-block" data-toggle="buttons">
+                    <label for="type_transfer" class="btn btn-sm btn-outline-primary active">
+                        <input type="radio" name="transaction_type" id="type_transfer">
+                        {% trans "Transfer" %}
                     </label>
-                    <label for="type_debit" class="btn btn-sm btn-outline-primary">
-                        <input type="radio" name="transaction_type" id="type_debit">
-                        {% trans "Debit" %}
-                    </label>
-                {% endif %}
+                    {% if "note.notespecial"|not_empty_model_list %}
+                        <label for="type_credit" class="btn btn-sm btn-outline-primary">
+                            <input type="radio" name="transaction_type" id="type_credit">
+                            {% trans "Credit" %}
+                        </label>
+                        <label for="type_debit" class="btn btn-sm btn-outline-primary">
+                            <input type="radio" name="transaction_type" id="type_debit">
+                            {% trans "Debit" %}
+                        </label>
+                    {% endif %}
+                </div>
+
+                {# Add shortcuts for opened activites if necessary #}
                 {% for activity in activities_open %}
                     <a href="{% url "activity:activity_entry" pk=activity.pk %}" class="btn btn-sm btn-outline-primary">
                         {% trans "Entries" %} {{ activity.name }}
diff --git a/apps/note/views.py b/apps/note/views.py
index 279eadc6..074da01d 100644
--- a/apps/note/views.py
+++ b/apps/note/views.py
@@ -53,7 +53,7 @@ class TransactionCreateView(ProtectQuerysetMixin, LoginRequiredMixin, SingleTabl
         # Add a shortcut for entry page for open activities
         if "activity" in settings.INSTALLED_APPS:
             from activity.models import Activity
-            activities_open = Activity.objects.filter(open=True).filter(
+            activities_open = Activity.objects.filter(open=True, activity_type__manage_entries=True).filter(
                 PermissionBackend.filter_queryset(self.request, Activity, "view")).distinct().all()
             context["activities_open"] = [a for a in activities_open
                                           if PermissionBackend.check_perm(self.request,