PCv5/app/templates/forum/forum.html

88 lines
2.4 KiB
HTML
Raw Normal View History

{% extends "base/base.html" %}
{% import "widgets/editor.html" as widget_editor %}
{% import "widgets/pagination.html" as widget_pagination with context %}
{% block title %}
<a href='/forum'>Forum de Planète Casio</a> » <h1>{{ f.name }}</h1>
{% endblock %}
{% block content %}
<section>
<p>{{ f.descr }}</p>
{% if topics.items %}
<h2>Sujets</h2>
{{ widget_pagination.paginate(topics, 'forum_page', None, {'f': f}) }}
<table class=topiclist>
<tr><th>Sujet</th><th>Auteur</th><th>Date de création</th>
<th>Commentaires</th><th>Vues</th></tr>
{% for t in topics.items %}
<tr><td><a href='{{ url_for('forum_topic', f=t.forum, page=(t,1)) }}'>{{ t.title }}</a></td>
<td><a href='{{ url_for('user', username=t.author.name) }}'>{{ t.author.name }}</a></td>
<td>{{ t.date_created | date }}</td>
<td>{{ comment_counts[t.thread.id] }}</td>
<td>{{ t.views }} </td></tr>
{% endfor %}
</table>
{{ widget_pagination.paginate(topics, 'forum_page', None, {'f': f}) }}
{% elif not f.sub_forums %}
<p>Il n'y a aucun topic sur ce forum ! Animons-le vite !</p>
{% endif %}
{% if f.sub_forums %}
<h2>Forums</h2>
<table class=forumlist>
<tr><th>{{ f.name }}</th><th>Nombre de sujets</th></tr>
{% for sf in f.sub_forums %}
<tr><td><a href='/forum{{ sf.url }}'>{{ sf.name }}</td>
<td>{{ sf.topics.count() }}</td></tr>
<tr><td>{{ sf.descr }}</td><td></td></tr>
{% endfor %}
</table>
{% endif %}
review of privileges and forum permissions * Sorted privileges into categories, similar to the v4.3 style Added privilege check utilities: * Forum: is_news(), is_default_accessible() and is_default_postable() * Member: can_access_forum(), can_post_in_forum(), can_edit_post(), and can_delete_post() Unfortunately current_user is not a Guest when logged out, so one cannot usually write current_user.can_*() without checking for authentication first, so the checks are still somewhat verbose. Reviewed forum permissions; the following permission issues have been fixed (I have tested most but not all of them prior to fixing): * app/routes/forum/index.py: Users that were not meant to access a forum could still obtain a listing of the topics * app/routes/forum/topic.py: Users that were not meant to see topics could still read them by browsing the URL * app/routes/forum/topic.py: Authenticated users could post in any topic, including ones that they should not have access to * app/routes/posts/edit.py: Users with edit.posts (eg. mods) could edit and delete messages in forums they can't access (eg. creativecalc) * app/templates/account/user.html: Users with admin panel access would see account editing links they can't use (affects developers) * app/templates/base/navbar/forum.html: The "Forum" tab would list all forums including ones the user doesn't have access to * app/templates/forum/index.html: Users would see every single forum, including ones they can't access * app/template/widgets/thread.html: Anyone would see Edit/Delete links on every message, even though most were unusable Miscellaneous changes: * app/routes/forum/topic.py: Ordered comments by date as intended, which I assume worked by chance until now * Removed the old assets/privs.txt files which is now superseded by the list implemented in app/data/groups.yaml This commit changes group and forum information, run master.py with: @> forums update @> groups update
2021-02-26 18:29:25 +01:00
{% if (V5Config.ENABLE_GUEST_POST and f.is_default_postable())
or (current_user.is_authenticated and current_user.can_post_in_forum(f)) %}
<div class=form>
<h2>Créer un nouveau sujet</h2>
<form action="" method="post" enctype="multipart/form-data">
{{ form.hidden_tag() }}
{% if form.pseudo %}
<div>
{{ form.pseudo.label }}
{{ form.pseudo() }}
{% for error in form.pseudo.errors %}
<span class="msgerror">{{ error }}</span>
{% endfor %}
</div>
{% endif %}
<div>
{{ form.title.label }}
{{ form.title() }}
{% for error in form.title.errors %}
<span class="msgerror">{{ error }}</span>
{% endfor %}
</div>
{{ widget_editor.text_editor(form.message) }}
{{ form.attachments }}
{% for error in form.attachments.errors %}
<span class="msgerror">{{ error }}</span>
{% endfor %}
2020-07-13 22:54:34 +02:00
<div>{{ form.submit(class_='bg-ok') }}</div>
</form>
</div>
{% endif %}
</section>
{% endblock %}