PCv5/app/routes/admin/config.py

from app.utils.priv_required import priv_required
from app.utils.render import render
from app import app
from config import V5Config

@app.route('/admin/config', methods=['GET'])
@priv_required('misc.admin-panel')
def adm_config():
    config = {k: getattr(V5Config, k) for k in [
        "DOMAIN", "DB_NAME", "USE_LDAP", "LDAP_ROOT", "LDAP_ENV",
        "ENABLE_GUEST_POST", "ENABLE_EMAIL_CONFIRMATION", "SEND_MAILS"
    ]}
    return render('admin/config.html', config=config)
admin: add a page to get configuration used 2020-08-27 23:12:31 +02:00			`from app.utils.priv_required import priv_required`
			`from app.utils.render import render`
			`from app import app`
			`from config import V5Config`

			`@app.route('/admin/config', methods=['GET'])`
review of privileges and forum permissions * Sorted privileges into categories, similar to the v4.3 style Added privilege check utilities: * Forum: is_news(), is_default_accessible() and is_default_postable() * Member: can_access_forum(), can_post_in_forum(), can_edit_post(), and can_delete_post() Unfortunately current_user is not a Guest when logged out, so one cannot usually write current_user.can_() without checking for authentication first, so the checks are still somewhat verbose. Reviewed forum permissions; the following permission issues have been fixed (I have tested most but not all of them prior to fixing): app/routes/forum/index.py: Users that were not meant to access a forum could still obtain a listing of the topics * app/routes/forum/topic.py: Users that were not meant to see topics could still read them by browsing the URL * app/routes/forum/topic.py: Authenticated users could post in any topic, including ones that they should not have access to * app/routes/posts/edit.py: Users with edit.posts (eg. mods) could edit and delete messages in forums they can't access (eg. creativecalc) * app/templates/account/user.html: Users with admin panel access would see account editing links they can't use (affects developers) * app/templates/base/navbar/forum.html: The "Forum" tab would list all forums including ones the user doesn't have access to * app/templates/forum/index.html: Users would see every single forum, including ones they can't access * app/template/widgets/thread.html: Anyone would see Edit/Delete links on every message, even though most were unusable Miscellaneous changes: * app/routes/forum/topic.py: Ordered comments by date as intended, which I assume worked by chance until now * Removed the old assets/privs.txt files which is now superseded by the list implemented in app/data/groups.yaml This commit changes group and forum information, run master.py with: @> forums update @> groups update 2021-02-26 18:29:25 +01:00			`@priv_required('misc.admin-panel')`
admin: add a page to get configuration used 2020-08-27 23:12:31 +02:00			`def adm_config():`
			`config = {k: getattr(V5Config, k) for k in [`
			`"DOMAIN", "DB_NAME", "USE_LDAP", "LDAP_ROOT", "LDAP_ENV",`
			`"ENABLE_GUEST_POST", "ENABLE_EMAIL_CONFIRMATION", "SEND_MAILS"`
			`]}`
			`return render('admin/config.html', config=config)`