Index: /main/waeup.kofa/trunk/src/waeup/kofa/applicants/browser.py
===================================================================
--- /main/waeup.kofa/trunk/src/waeup/kofa/applicants/browser.py	(revision 13990)
+++ /main/waeup.kofa/trunk/src/waeup/kofa/applicants/browser.py	(revision 13991)
@@ -1511,5 +1511,5 @@
     """
     grok.context(IApplicant)
-    grok.require('waeup.manageApplication') # XXX: Will be public
+    grok.require('waeup.Public')
     grok.name('addrefereereport')
     form_fields = grok.AutoFields(
@@ -1520,5 +1520,26 @@
 
     def update(self):
-        # XXX: Check mandate
+        blocker = grok.getSite()['configuration'].maintmode_enabled_by
+        if blocker:
+            self.flash(_('The portal is in maintenance mode. '
+                        'Referee report forms are temporarily disabled.'),
+                       type='warning')
+            self.redirect(self.application_url())
+            return
+        # Check mandate
+        form = self.request.form
+        mandate_id = form.get('mandate_id', None)
+        mandates = grok.getSite()['mandates']
+        mandate = mandates.get(mandate_id, None)
+        if mandate is None and not self.request.form.get('form.actions.submit'):
+            self.flash(_('No mandate.'), type='warning')
+            self.redirect(self.application_url())
+            return
+        if mandate:
+            # Prefill form with mandate params
+            self.form_fields.get(
+                'name').field.default = mandate.params['name']
+            self.form_fields.get(
+                'email').field.default = mandate.params['email']
         super(RefereeReportAddFormPage, self).update()
         return
@@ -1535,9 +1556,8 @@
         self.applyData(report, **data)
         self.context[report.r_id] = report
-        self.flash(_('Referee report created.'))
+        self.flash(_('Referee report has been saved. Thank you!'))
         self.context.writeLogMessage(self, 'added: %s' % report.r_id)
-        # XXX: Email has to be sent.
-        # XXX: Will be replaced by landing page
-        self.redirect(
-            self.url(self.context[report.r_id], 'index'))
-        return
+        # XXX: Delete mandate
+        # XXX: Send email
+        self.redirect(self.application_url())
+        return
Index: /main/waeup.kofa/trunk/src/waeup/kofa/applicants/tests/test_browser.py
===================================================================
--- /main/waeup.kofa/trunk/src/waeup/kofa/applicants/tests/test_browser.py	(revision 13990)
+++ /main/waeup.kofa/trunk/src/waeup/kofa/applicants/tests/test_browser.py	(revision 13991)
@@ -47,4 +47,5 @@
 from waeup.kofa.university.faculty import Faculty
 from waeup.kofa.university.department import Department
+from waeup.kofa.mandates.mandate import RefereeReportMandate
 from waeup.kofa.tests.test_async import FunctionalAsyncTestCase
 
@@ -1525,21 +1526,64 @@
     layer = FunctionalLayer
 
+    def test_refereereport_mandate(self):
+        mandate = RefereeReportMandate()
+        mandate.params['name'] = u'John Referee'
+        mandate.params['email'] = 'aa@aa.aa'
+        mandate.params[
+            'redirect_path'] = '/applicants/%s/%s/addrefereereport' % (
+                container_name_1, self.applicant.application_number)
+        self.app['mandates'].addMandate(mandate)
+        # Let's open the add form page via the mandate view
+        self.browser.open('http://localhost/app/mandate?mandate_id=%s'
+            % mandate.mandate_id)
+        # Form page opens and is prefilled
+        self.assertEqual(
+            self.browser.url,
+            'http://localhost/app/applicants/%s/%s/addrefereereport?mandate_id=%s'
+            % (container_name_1, self.applicant.application_number,
+            mandate.mandate_id))
+        self.assertTrue('value="John Referee"' in self.browser.contents)
+        # Let's open the page directly with an invalid mandate
+        self.browser.open(
+            'http://localhost/app/applicants/%s/%s/addrefereereport?mandate_id=wrongmadate'
+            % (container_name_1, self.applicant.application_number))
+        self.assertTrue('<div class="alert alert-warning">No mandate.</div>'
+            in self.browser.contents)
+        self.assertEqual(self.browser.url, 'http://localhost/app')
+        # Page is also blocked in maintenance mode
+        grok.getSite()['configuration'].maintmode_enabled_by = u'anybody'
+        self.browser.open(
+            'http://localhost/app/applicants/%s/%s/addrefereereport?mandate_id=%s'
+            % (container_name_1, self.applicant.application_number,
+            mandate.mandate_id))
+        self.assertTrue('<div class="alert alert-warning">The portal is '
+                        'in maintenance mode'
+            in self.browser.contents)
+        self.assertEqual(self.browser.url, 'http://localhost/app')
+
     def test_add_and_view_reports(self):
-        # Managers can view reports
-        self.browser.addHeader('Authorization', 'Basic mgr:mgrpw')
-        self.browser.open(self.manage_path)
-        # So far no report has been added
-        self.assertFalse('Referee' in self.browser.contents)
-        # XXX: Form will be public
-        self.browser.open(self.view_path + '/addrefereereport')
-        self.browser.getControl(name="form.name").value = 'John Trust'
-        self.browser.getControl(name="form.email").value = 'xx@yy.zz'
+        mandate = RefereeReportMandate()
+        mandate.params['name'] = u'John Referee'
+        mandate.params['email'] = 'aa@aa.aa'
+        mandate.params[
+            'redirect_path'] = '/applicants/%s/%s/addrefereereport' % (
+                container_name_1, self.applicant.application_number)
+        self.app['mandates'].addMandate(mandate)
+        # Let's open the add form page via the mandate view
+        self.browser.open('http://localhost/app/mandate?mandate_id=%s'
+            % mandate.mandate_id)
         self.browser.getControl("Submit").click()
-        self.assertTrue('Referee report created' in self.browser.contents)
-        # Report has been created and we are viewing the report's index page
+        self.assertTrue('Referee report has been saved' in self.browser.contents)
+        self.assertEqual(self.browser.url, 'http://localhost/app')
+        # Report has been created
         self.assertEqual(len(self.applicant.refereereports), 1)
         report = self.applicant.refereereports[0]
+        # Managers can view the report
+        self.browser.addHeader('Authorization', 'Basic mgr:mgrpw')
+        self.browser.open(self.manage_path)
+        self.browser.getLink("%s" % report.r_id).click()
         self.assertEqual(
-            self.browser.url, self.view_path  + '/%s/index' % report.r_id)
+            self.browser.url, self.view_path  + '/%s' % report.r_id)
+        self.assertTrue('John Referee' in self.browser.contents)
         # Report creation is logged
         logfile = os.path.join(
@@ -1547,5 +1591,5 @@
         logcontent = open(logfile).read()
         self.assertTrue(
-            'zope.mgr - applicants.browser.RefereeReportAddFormPage - '
+            'zope.anybody - applicants.browser.RefereeReportAddFormPage - '
             '%s - added: %s\n' % (self.applicant.applicant_id, report.r_id)
             in logcontent
