PCv5/app/templates/base/navbar/forum.html

28 lines
737 B
HTML
Raw Normal View History

2018-02-26 10:24:16 +01:00
<div>
<h2>
<svg viewBox="0 0 24 24">
<path fill="#ffffff" d="M17,12V3A1,1 0 0,0 16,2H3A1,1 0 0,0 2,3V17L6,13H16A1,1 0 0,0 17,12M21,6H19V15H6V17A1,1 0 0,0 7,18H18L22,22V7A1,1 0 0,0 21,6Z"></path>
</svg>
Forum
</h2>
<a href='{{ url_for('forum_index') }}'>Index du forum</a>
<hr>
{% for f in main_forum.sub_forums %}
review of privileges and forum permissions * Sorted privileges into categories, similar to the v4.3 style Added privilege check utilities: * Forum: is_news(), is_default_accessible() and is_default_postable() * Member: can_access_forum(), can_post_in_forum(), can_edit_post(), and can_delete_post() Unfortunately current_user is not a Guest when logged out, so one cannot usually write current_user.can_*() without checking for authentication first, so the checks are still somewhat verbose. Reviewed forum permissions; the following permission issues have been fixed (I have tested most but not all of them prior to fixing): * app/routes/forum/index.py: Users that were not meant to access a forum could still obtain a listing of the topics * app/routes/forum/topic.py: Users that were not meant to see topics could still read them by browsing the URL * app/routes/forum/topic.py: Authenticated users could post in any topic, including ones that they should not have access to * app/routes/posts/edit.py: Users with edit.posts (eg. mods) could edit and delete messages in forums they can't access (eg. creativecalc) * app/templates/account/user.html: Users with admin panel access would see account editing links they can't use (affects developers) * app/templates/base/navbar/forum.html: The "Forum" tab would list all forums including ones the user doesn't have access to * app/templates/forum/index.html: Users would see every single forum, including ones they can't access * app/template/widgets/thread.html: Anyone would see Edit/Delete links on every message, even though most were unusable Miscellaneous changes: * app/routes/forum/topic.py: Ordered comments by date as intended, which I assume worked by chance until now * Removed the old assets/privs.txt files which is now superseded by the list implemented in app/data/groups.yaml This commit changes group and forum information, run master.py with: @> forums update @> groups update
2021-02-26 18:29:25 +01:00
{% if f.is_default_accessible() or
(current_user.is_authenticated and current_user.can_access_forum(f)) %}
<a href="{{ url_for('forum_page', f=f) }}">{{ f.name }}</a>
{% endif %}
{% endfor %}
2018-02-26 10:24:16 +01:00
<hr>
2018-02-26 10:24:16 +01:00
<h3>Derniers topics actifs</h3>
2018-02-26 10:24:16 +01:00
<ul>
{% for t in last_active_topics %}
<li><a href="{{ url_for('forum_topic', f=t.forum, page=(t,'fin'))}}">{{ t.title }}</a></li>
{% endfor %}
2018-02-26 10:24:16 +01:00
</ul>
</div>