roundabout,
created on Friday, 25 October 2024, 10:28:47 (1729852127),
received on Friday, 25 October 2024, 10:29:15 (1729852155)
Author identity: vlad <vlad.muntoiu@gmail.com>
86b6f4bb373957ed8bad4d726278ee03847f467a
app.py
@@ -1847,3 +1847,29 @@ def api_gallery_remove_user(id):
return flask.jsonify({"message": "User removed from gallery"})
@app.route("/api/gallery/<int:id>/delete", methods=["POST"])
def api_delete_gallery(id):
gallery = db.session.get(Gallery, id)
if gallery is None:
flask.abort(404)
current_user = db.session.get(User, flask.session.get("username"))
if current_user is None:
flask.abort(401)
if current_user != gallery.owner and not current_user.admin:
flask.abort(403)
for picture_in_gallery in gallery.pictures:
db.session.delete(picture_in_gallery)
for user_in_gallery in gallery.users:
db.session.delete(user_in_gallery)
db.session.delete(gallery)
db.session.commit()
return flask.jsonify({"message": "Gallery deleted"})