Lephe
6f98cba65e
* Sorted privileges into categories, similar to the v4.3 style Added privilege check utilities: * Forum: is_news(), is_default_accessible() and is_default_postable() * Member: can_access_forum(), can_post_in_forum(), can_edit_post(), and can_delete_post() Unfortunately current_user is not a Guest when logged out, so one cannot usually write current_user.can_*() without checking for authentication first, so the checks are still somewhat verbose. Reviewed forum permissions; the following permission issues have been fixed (I have tested most but not all of them prior to fixing): * app/routes/forum/index.py: Users that were not meant to access a forum could still obtain a listing of the topics * app/routes/forum/topic.py: Users that were not meant to see topics could still read them by browsing the URL * app/routes/forum/topic.py: Authenticated users could post in any topic, including ones that they should not have access to * app/routes/posts/edit.py: Users with edit.posts (eg. mods) could edit and delete messages in forums they can't access (eg. creativecalc) * app/templates/account/user.html: Users with admin panel access would see account editing links they can't use (affects developers) * app/templates/base/navbar/forum.html: The "Forum" tab would list all forums including ones the user doesn't have access to * app/templates/forum/index.html: Users would see every single forum, including ones they can't access * app/template/widgets/thread.html: Anyone would see Edit/Delete links on every message, even though most were unusable Miscellaneous changes: * app/routes/forum/topic.py: Ordered comments by date as intended, which I assume worked by chance until now * Removed the old assets/privs.txt files which is now superseded by the list implemented in app/data/groups.yaml This commit changes group and forum information, run master.py with: @> forums update @> groups update
50 lines
1.3 KiB
HTML
50 lines
1.3 KiB
HTML
{% extends "base/base.html" %}
|
||
|
||
{% block title %}
|
||
<h1>Forum de Planète Casio</h1>
|
||
{% endblock %}
|
||
|
||
{% block content %}
|
||
<section>
|
||
<p>
|
||
Bienvenue sur le forum de Planète Casio ! Vous pouvez créer des
|
||
nouveaux sujets ou poster des réponses avec un compte
|
||
{%- if not current_user.is_authenticated %}
|
||
ou en postant en tant qu'invité
|
||
{%- endif -%}
|
||
.
|
||
</p>
|
||
|
||
{% if main_forum == None %}
|
||
<p>Il n'y a aucun forum.</p>
|
||
{% else %}
|
||
|
||
{% for l1 in main_forum.sub_forums %}
|
||
{% if l1.is_default_accessible() or
|
||
(current_user.is_authenticated and current_user.can_access_forum(l1)) %}
|
||
<table class=forumlist>
|
||
<tr><th>{{ l1.name }}</th><th>Nombre de sujets</th></tr>
|
||
|
||
{% if l1.sub_forums == [] %}
|
||
<tr><td><a href='/forum{{ l1.url }}'>{{ l1.name }}</a></td>
|
||
<td>{{ l1.topics.count() }}</td></tr>
|
||
<tr><td>{{ l1.descr }}</td><td></td></tr>
|
||
{% endif %}
|
||
|
||
{% for l2 in l1.sub_forums %}
|
||
{% if l2.is_default_accessible() or
|
||
(current_user.is_authenticated and current_user.can_access_forum(l2)) %}
|
||
<tr><td><a href='/forum{{ l2.url }}'>{{ l2.name }}</td>
|
||
<td>{{ l2.topics.count() }}</td></tr>
|
||
<tr><td>{{ l2.descr }}</td><td></td></tr>
|
||
{% endif %}
|
||
{% endfor %}
|
||
|
||
</table>
|
||
{% endif %}
|
||
{% endfor %}
|
||
|
||
{% endif %}
|
||
</section>
|
||
{% endblock %}
|