Access control for state change

app.py

@@ -1,4 +1,4 @@

                                
                                
                                
                            
                                
                                    
                                        1 -
                                        __version__ = "0.1.2"
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        1 +
                                        __version__ = "0.2.0"
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            2  
                                            
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            3  
                                            import os
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            4  
                                            import shutil
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        

@@ -49,7 +49,6 @@ db = SQLAlchemy(app)

                                
                                
                                
                            
                                
                                    
                                        
                                            49  
                                            bcrypt = Bcrypt(app)
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            50  
                                            migrate = Migrate(app, db)
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            51  
                                            
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        52 -
                                        from models import *
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            52  
                                            from misc_utils import *
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            53  
                                            
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            54  
                                            import git_http
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        

@@ -59,6 +58,8 @@ from celery import Celery, Task

                                
                                
                                
                            
                                
                                    
                                        
                                            58  
                                            import celery_integration
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            59  
                                            import pathlib
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            60  
                                            
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        61 +
                                        from models import *
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        62 +
                                        
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            63  
                                            babel = Babel(app)
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            64  
                                            
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            65  
                                            
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        

@@ -853,6 +854,9 @@ def repository_forum_thread(username, repository, post_id):

                                
                                
                                
                            
                                
                                    
                                        
                                            854  
                                                        remote=f"http{'s' if config.suggest_https else ''}://{config.BASE_DOMAIN}/git/{username}/{repository}",
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            855  
                                                        is_favourite=get_favourite(flask.session.get("username"), username, repository),
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            856  
                                                        parent=Post.query.filter_by(repo=repo_data, number=post_id).first(),
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        857 +
                                                    has_permission=not ((not get_permission_level(flask.session.get("username"), username,
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        858 +
                                                                                             repository)) and db.session.get(Post,
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        859 +
                                                                                                                             f"/{username}/{repository}/{post_id}").owner.username != flask.session.get("username")),
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            860  
                                                )
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            861  
                                            
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            862  
                                            
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        

@@ -863,9 +867,7 @@ def repository_forum_change_state(username, repository, post_id):

                                
                                
                                
                            
                                
                                    
                                        
                                            867  
                                                if not os.path.exists(server_repo_location):
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            868  
                                                    app.logger.error(f"Cannot load {server_repo_location}")
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            869  
                                                    flask.abort(404)
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        866 -
                                            if not (get_visibility(username, repository) or get_permission_level(
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        867 -
                                                    flask.session.get("username"), username,
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        868 -
                                                    repository) is not None):
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        870 +
                                            if (not get_permission_level(flask.session.get("username"), username, repository)) and db.session.get(Post, f"/{username}/{repository}/{post_id}").owner.username != flask.session.get("username"):
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            871  
                                                    flask.abort(403)
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            872  
                                            
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            873  
                                                app.logger.info(f"Loading {server_repo_location}")
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                            
                                

git_http.py

@@ -1,7 +1,8 @@

                                
                                
                                
                            
                                
                                    
                                        
                                            1  
                                            import uuid
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            2  
                                            
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            3  
                                            from models import *
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        4 -
                                        from app import app, git_command, get_permission_level, get_visibility, db, bcrypt
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        4 +
                                        from app import app, db, bcrypt
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        5 +
                                        from misc_utils import *
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            6  
                                            import os
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            7  
                                            import shutil
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            8  
                                            import config
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                            
                                

models.py

@@ -141,7 +141,6 @@ with (app.app_context()):

                                
                                
                                
                            
                                
                                    
                                        
                                            141  
                                                        celery_tasks.send_notification.apply_async(args=[user_notification.id])
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            142  
                                            
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            143  
                                            
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        144 -
                                        
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            144  
                                                class Repo(db.Model):
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            145  
                                                    route = db.Column(db.String(98), unique=True, nullable=False, primary_key=True)
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            146  
                                                    owner_name = db.Column(db.String(32), db.ForeignKey("user.username"), nullable=False)
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                            
                                

templates/repository/repo-forum-thread.html

@@ -16,17 +16,19 @@

                                
                                
                                
                            
                                
                                    
                                        
                                            16  
                                            
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            17  
                                                        <div class="flexible-space"></div>
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            18  
                                            
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        19 -
                                                    <form action="{{ parent.number }}/change-state" method="post">
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        20 -
                                                        {% if parent.state == 0 %}
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        21 -
                                                            <button type="submit" name="new-state" value="1" style="background: var(--color-done); color: var(--color-done-text);">
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        22 -
                                                                {% trans %}done{% endtrans %}
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        23 -
                                                            </button>
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        24 -
                                                        {% elif parent.state == 1 %}
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        25 -
                                                            <button type="submit" name="new-state" value="0" style="background: var(--color-pending); color: var(--color-pending-text);">
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        26 -
                                                                {% trans %}active{% endtrans %}
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        27 -
                                                            </button>
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        28 -
                                                        {% endif %}
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        29 -
                                                    </form>
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        19 +
                                                    {% if has_permission %}
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        20 +
                                                        <form action="{{ parent.number }}/change-state" method="post">
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        21 +
                                                            {% if parent.state == 0 %}
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        22 +
                                                                <button type="submit" name="new-state" value="1" style="background: var(--color-done); color: var(--color-done-text);">
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        23 +
                                                                    {% trans %}done{% endtrans %}
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        24 +
                                                                </button>
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        25 +
                                                            {% elif parent.state == 1 %}
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        26 +
                                                                <button type="submit" name="new-state" value="0" style="background: var(--color-pending); color: var(--color-pending-text);">
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        27 +
                                                                    {% trans %}active{% endtrans %}
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        28 +
                                                                </button>
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        29 +
                                                            {% endif %}
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        30 +
                                                        </form>
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        31 +
                                                    {% endif %}
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            32  
                                                    {% else %}
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            33  
                                                        <a href="." class="button icon-button">
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            34  
                                                            <iconify-icon icon="mdi:arrow-left"></iconify-icon>