roundabout,
created on Friday, 25 October 2024, 10:28:47 (1729852127),
received on Friday, 25 October 2024, 10:29:15 (1729852155)
Author identity: vlad <vlad.muntoiu@gmail.com>
86b6f4bb373957ed8bad4d726278ee03847f467a
app.py
@@ -1847,3 +1847,29 @@ def api_gallery_remove_user(id):
return flask.jsonify({"message": "User removed from gallery"}) @app.route("/api/gallery/<int:id>/delete", methods=["POST"]) def api_delete_gallery(id): gallery = db.session.get(Gallery, id) if gallery is None: flask.abort(404) current_user = db.session.get(User, flask.session.get("username")) if current_user is None: flask.abort(401) if current_user != gallery.owner and not current_user.admin: flask.abort(403) for picture_in_gallery in gallery.pictures: db.session.delete(picture_in_gallery) for user_in_gallery in gallery.users: db.session.delete(user_in_gallery) db.session.delete(gallery) db.session.commit() return flask.jsonify({"message": "Gallery deleted"})