2019-06-06 01:45:39 +02:00
|
|
|
from app.utils.priv_required import priv_required
|
|
|
|
from flask_wtf import FlaskForm
|
|
|
|
from wtforms import SubmitField
|
2020-11-01 15:59:38 +01:00
|
|
|
from app.models.user import Member, GroupMember, Group, GroupPrivilege
|
2020-08-06 21:19:01 +02:00
|
|
|
from app.models.priv import SpecialPrivilege
|
2019-06-06 01:45:39 +02:00
|
|
|
from app.utils.render import render
|
|
|
|
from app import app, db
|
|
|
|
import yaml
|
|
|
|
import os
|
|
|
|
|
|
|
|
|
2019-12-16 23:57:50 +01:00
|
|
|
@app.route('/admin/groupes', methods=['GET', 'POST'])
|
review of privileges and forum permissions
* Sorted privileges into categories, similar to the v4.3 style
Added privilege check utilities:
* Forum: is_news(), is_default_accessible() and is_default_postable()
* Member: can_access_forum(), can_post_in_forum(), can_edit_post(),
and can_delete_post()
Unfortunately current_user is not a Guest when logged out, so one
cannot usually write current_user.can_*() without checking for
authentication first, so the checks are still somewhat verbose.
Reviewed forum permissions; the following permission issues have been
fixed (I have tested most but not all of them prior to fixing):
* app/routes/forum/index.py: Users that were not meant to access a
forum could still obtain a listing of the topics
* app/routes/forum/topic.py: Users that were not meant to see topics
could still read them by browsing the URL
* app/routes/forum/topic.py: Authenticated users could post in any
topic, including ones that they should not have access to
* app/routes/posts/edit.py: Users with edit.posts (eg. mods) could edit
and delete messages in forums they can't access (eg. creativecalc)
* app/templates/account/user.html: Users with admin panel access would
see account editing links they can't use (affects developers)
* app/templates/base/navbar/forum.html: The "Forum" tab would list all
forums including ones the user doesn't have access to
* app/templates/forum/index.html: Users would see every single forum,
including ones they can't access
* app/template/widgets/thread.html: Anyone would see Edit/Delete links
on every message, even though most were unusable
Miscellaneous changes:
* app/routes/forum/topic.py: Ordered comments by date as intended,
which I assume worked by chance until now
* Removed the old assets/privs.txt files which is now superseded by the
list implemented in app/data/groups.yaml
This commit changes group and forum information, run master.py with:
@> forums update
@> groups update
2021-02-26 18:29:25 +01:00
|
|
|
@priv_required('misc.admin-panel')
|
2019-06-06 01:45:39 +02:00
|
|
|
def adm_groups():
|
2020-11-01 15:59:38 +01:00
|
|
|
# Users with either groups or special privileges
|
|
|
|
users_groups = Member.query.join(GroupMember)
|
|
|
|
users_special = Member.query \
|
2022-05-12 20:19:17 +02:00
|
|
|
.join(SpecialPrivilege, Member.id == SpecialPrivilege.member_id)
|
2020-11-01 15:59:38 +01:00
|
|
|
users = users_groups.union(users_special)
|
|
|
|
users = sorted(users, key = lambda x: x.name)
|
2019-06-06 01:45:39 +02:00
|
|
|
|
2020-11-01 15:59:38 +01:00
|
|
|
groups = Group.query.all()
|
2019-06-06 19:54:01 +02:00
|
|
|
return render('admin/groups_privileges.html', users=users, groups=groups)
|