X-Git-Url: https://vcs.fsf.org/?a=blobdiff_plain;f=mediagoblin%2Fdecorators.py;h=daeddb3f199352258988eef024d4022b705cce29;hb=283043f14d8fdeb8cccad00b7d7cb7a8cc5a17bd;hp=302ab2472a97c1594fa0ac6eb6f6f14288fc5c09;hpb=670717d950c4bb5ef908c23e46df4016b5dc2bd2;p=mediagoblin.git diff --git a/mediagoblin/decorators.py b/mediagoblin/decorators.py index 302ab247..daeddb3f 100644 --- a/mediagoblin/decorators.py +++ b/mediagoblin/decorators.py @@ -16,31 +16,53 @@ from functools import wraps -from urlparse import urljoin from werkzeug.exceptions import Forbidden, NotFound from oauthlib.oauth1 import ResourceEndpoint +from six.moves.urllib.parse import urljoin + from mediagoblin import mg_globals as mgg from mediagoblin import messages -from mediagoblin.db.models import MediaEntry, User -from mediagoblin.tools.response import json_response, redirect, render_404 +from mediagoblin.db.models import MediaEntry, LocalUser, TextComment, \ + AccessToken, Comment +from mediagoblin.tools.response import ( + redirect, render_404, + render_user_banned, json_response) from mediagoblin.tools.translate import pass_to_ugettext as _ -from mediagoblin.federation.tools.request import decode_authorization_header -from mediagoblin.federation.oauth import GMGRequestValidator +from mediagoblin.oauth.tools.request import decode_authorization_header +from mediagoblin.oauth.oauth import GMGRequestValidator + + +def user_not_banned(controller): + """ + Requires that the user has not been banned. Otherwise redirects to the page + explaining why they have been banned + """ + @wraps(controller) + def wrapper(request, *args, **kwargs): + if request.user: + if request.user.is_banned(): + return render_user_banned(request) + return controller(request, *args, **kwargs) + + return wrapper + def require_active_login(controller): """ - Require an active login from the user. + Require an active login from the user. If the user is banned, redirects to + the "You are Banned" page. """ @wraps(controller) + @user_not_banned def new_controller_func(request, *args, **kwargs): if request.user and \ - request.user.status == u'needs_email_verification': + not request.user.has_privilege(u'active'): return redirect( request, 'mediagoblin.user_pages.user_home', user=request.user.username) - elif not request.user or request.user.status != u'active': + elif not request.user or not request.user.has_privilege(u'active'): next_url = urljoin( request.urlgen('mediagoblin.auth.login', qualified=True), @@ -53,13 +75,44 @@ def require_active_login(controller): return new_controller_func + +def user_has_privilege(privilege_name, allow_admin=True): + """ + Requires that a user have a particular privilege in order to access a page. + In order to require that a user have multiple privileges, use this + decorator twice on the same view. This decorator also makes sure that the + user is not banned, or else it redirects them to the "You are Banned" page. + + :param privilege_name A unicode object that is that represents + the privilege object. This object is + the name of the privilege, as assigned + in the Privilege.privilege_name column + + :param allow_admin If this is true then if the user is an admin + it will allow the user even if the user doesn't + have the privilage given in privilage_name. + """ + + def user_has_privilege_decorator(controller): + @wraps(controller) + @require_active_login + def wrapper(request, *args, **kwargs): + if not request.user.has_privilege(privilege_name, allow_admin): + raise Forbidden() + + return controller(request, *args, **kwargs) + + return wrapper + return user_has_privilege_decorator + + def active_user_from_url(controller): - """Retrieve User() from URL pattern and pass in as url_user=... + """Retrieve LocalUser() from URL pattern and pass in as url_user=... Returns a 404 if no such active user has been found""" @wraps(controller) def wrapper(request, *args, **kwargs): - user = User.query.filter_by(username=request.matchdict['user']).first() + user = LocalUser.query.filter_by(username=request.matchdict['user']).first() if user is None: return render_404(request) @@ -74,8 +127,8 @@ def user_may_delete_media(controller): """ @wraps(controller) def wrapper(request, *args, **kwargs): - uploader_id = kwargs['media'].uploader - if not (request.user.is_admin or + uploader_id = kwargs['media'].actor + if not (request.user.has_privilege(u'admin') or request.user.id == uploader_id): raise Forbidden() @@ -90,9 +143,9 @@ def user_may_alter_collection(controller): """ @wraps(controller) def wrapper(request, *args, **kwargs): - creator_id = request.db.User.query.filter_by( + creator_id = request.db.LocalUser.query.filter_by( username=request.matchdict['user']).first().id - if not (request.user.is_admin or + if not (request.user.has_privilege(u'admin') or request.user.id == creator_id): raise Forbidden() @@ -125,7 +178,7 @@ def get_user_media_entry(controller): """ @wraps(controller) def wrapper(request, *args, **kwargs): - user = User.query.filter_by(username=request.matchdict['user']).first() + user = LocalUser.query.filter_by(username=request.matchdict['user']).first() if not user: raise NotFound() @@ -140,7 +193,7 @@ def get_user_media_entry(controller): media = MediaEntry.query.filter_by( id=int(media_slug[3:]), state=u'processed', - uploader=user.id).first() + actor=user.id).first() except ValueError: raise NotFound() else: @@ -148,7 +201,7 @@ def get_user_media_entry(controller): media = MediaEntry.query.filter_by( slug=media_slug, state=u'processed', - uploader=user.id).first() + actor=user.id).first() if not media: # Didn't find anything? Okay, 404. @@ -165,7 +218,7 @@ def get_user_collection(controller): """ @wraps(controller) def wrapper(request, *args, **kwargs): - user = request.db.User.query.filter_by( + user = request.db.LocalUser.query.filter_by( username=request.matchdict['user']).first() if not user: @@ -173,7 +226,7 @@ def get_user_collection(controller): collection = request.db.Collection.query.filter_by( slug=request.matchdict['collection'], - creator=user.id).first() + actor=user.id).first() # Still no collection? Okay, 404. if not collection: @@ -190,7 +243,7 @@ def get_user_collection_item(controller): """ @wraps(controller) def wrapper(request, *args, **kwargs): - user = request.db.User.query.filter_by( + user = request.db.LocalUser.query.filter_by( username=request.matchdict['user']).first() if not user: @@ -222,7 +275,7 @@ def get_media_entry_by_id(controller): return render_404(request) given_username = request.matchdict.get('user') - if given_username and (given_username != media.get_uploader.username): + if given_username and (given_username != media.get_actor.username): return render_404(request) return controller(request, media=media, *args, **kwargs) @@ -256,6 +309,49 @@ def allow_registration(controller): return wrapper +def allow_reporting(controller): + """ Decorator for if reporting is enabled""" + @wraps(controller) + def wrapper(request, *args, **kwargs): + if not mgg.app_config["allow_reporting"]: + messages.add_message( + request, + messages.WARNING, + _('Sorry, reporting is disabled on this instance.')) + return redirect(request, 'index') + + return controller(request, *args, **kwargs) + + return wrapper + +def get_optional_media_comment_by_id(controller): + """ + Pass in a Comment based off of a url component. Because of this decor- + -ator's use in filing Reports, it has two valid outcomes. + + :returns The view function being wrapped with kwarg `comment` set to + the Comment who's id is in the URL. If there is a + comment id in the URL and if it is valid. + :returns The view function being wrapped with kwarg `comment` set to + None. If there is no comment id in the URL. + :returns A 404 Error page, if there is a comment if in the URL and it + is invalid. + """ + @wraps(controller) + def wrapper(request, *args, **kwargs): + if 'comment' in request.matchdict: + comment = Comment.query.filter_by( + id=request.matchdict['comment'] + ).first() + + if comment is None: + return render_404(request) + + return controller(request, comment=comment, *args, **kwargs) + else: + return controller(request, comment=None, *args, **kwargs) + return wrapper + def auth_enabled(controller): """Decorator for if an auth plugin is enabled""" @@ -272,6 +368,32 @@ def auth_enabled(controller): return wrapper +def require_admin_or_moderator_login(controller): + """ + Require a login from an administrator or a moderator. + """ + @wraps(controller) + def new_controller_func(request, *args, **kwargs): + if request.user and \ + not (request.user.has_privilege(u'admin') + or request.user.has_privilege(u'moderator')): + + raise Forbidden() + elif not request.user: + next_url = urljoin( + request.urlgen('mediagoblin.auth.login', + qualified=True), + request.url) + + return redirect(request, 'mediagoblin.auth.login', + next=next_url) + + return controller(request, *args, **kwargs) + + return new_controller_func + + + def oauth_required(controller): """ Used to wrap API endpoints where oauth is required """ @wraps(controller) @@ -283,20 +405,27 @@ def oauth_required(controller): error = "Missing required parameter." return json_response({"error": error}, status=400) - + request_validator = GMGRequestValidator() resource_endpoint = ResourceEndpoint(request_validator) - valid, request = resource_endpoint.validate_protected_resource_request( + valid, r = resource_endpoint.validate_protected_resource_request( uri=request.url, http_method=request.method, - body=request.get_data(), + body=request.data, headers=dict(request.headers), ) if not valid: - error = "Invalid oauth prarameter." + error = "Invalid oauth parameter." return json_response({"error": error}, status=400) + # Fill user if not already + token = authorization[u"oauth_token"] + request.access_token = AccessToken.query.filter_by(token=token).first() + if request.access_token is not None and request.user is None: + user_id = request.access_token.actor + request.user = LocalUser.query.filter_by(id=user_id).first() + return controller(request, *args, **kwargs) return wrapper