X-Git-Url: https://code.wpia.club/?a=blobdiff_plain;f=motion.py;h=1c83fc997a0460005b1947d9cb91e4b2831ba816;hb=0e21faff8279cf573c0483ff3be5092beef0e8e9;hp=eb04effb9844d7734e69549b93532a265110b391;hpb=1aa987d0d2f2c0a82b5bc0bbfe89eb1646b297a7;p=motion.git

diff --git a/motion.py b/motion.py
index eb04eff..1c83fc9 100644
--- a/motion.py
+++ b/motion.py
@@ -2,8 +2,12 @@ from flask import g
 from flask import Flask
 from flask import render_template, redirect
 from flask import request
+from functools import wraps
 import postgresql
 import filters
+from flaskext.markdown import Markdown
+from markdown.extensions import Extension
+from datetime import date, time, datetime
 
 def get_db():
     db = getattr(g, '_database', None)
@@ -15,14 +19,30 @@ def get_db():
 app = Flask(__name__)
 app.register_blueprint(filters.blueprint)
 
+class EscapeHtml(Extension):
+    def extendMarkdown(self, md, md_globals):
+        del md.preprocessors['html_block']
+        del md.inlinePatterns['html']
+
+md = Markdown(app, extensions=[EscapeHtml()])
+
 # Load config
 app.config.from_pyfile('config.py')
 
-prefix=app.config.get("GROUP_PREFIX")
 
-times=app.config.get("DURATION")
+class ConfigProxy:
+    def __init__(self, name):
+        self.name = name
+    @property
+    def per_host(self):
+        dict = app.config.get(self.name)
+        if dict is None:
+            return None
+        return dict.get(request.host)
 
-debuguser=app.config.get("DEBUGUSER")
+prefix = ConfigProxy("GROUP_PREFIX")
+times = ConfigProxy("DURATION")
+debuguser = ConfigProxy("DEBUGUSER")
 
 @app.before_request
 def lookup_user():
@@ -30,8 +50,9 @@ def lookup_user():
 
     env = request.environ
     user = None
-    if debuguser is not None:
-        parts =debuguser[request.host].split("/", 1)
+    my_debuguser = debuguser.per_host
+    if my_debuguser is not None:
+        parts = my_debuguser.split("/", 1)
         user = parts[0]
         roles = parts[1]
 
@@ -44,7 +65,6 @@ def lookup_user():
         user = env.get("USER")
         roles = env.get("ROLES")
 
-
     if user is None:
         return "Server misconfigured", 500
     roles = roles.split(" ")
@@ -69,7 +89,7 @@ def lookup_user():
             if a[0] not in g.roles:
                 g.roles[a[0]] = []
             if val == "*":
-                g.roles[a[0]] = [group for group in prefix[request.host]]
+                g.roles[a[0]] = [group for group in prefix.per_host]
             else:
                 g.roles[a[0]].append(val)
     return None
@@ -152,8 +172,8 @@ def main():
             prev = rs[9][0]
         else:
             prev = -1
-    return render_template('index.html', motions=rv[:10], more=rv[10]["id"] if len(rv) == 11 else None, times=times[request.host], prev=prev,
-                           categories=get_allowed_cats("create"))
+    return render_template('index.html', motions=rv[:10], more=rv[10]["id"] if len(rv) == 11 else None, times=times.per_host, prev=prev,
+                           categories=get_allowed_cats("create"), singlemotion=False)
 
 def rel_redirect(loc):
     r = redirect(loc)
@@ -166,7 +186,7 @@ def put_motion():
     if cat not in get_allowed_cats("create"):
         return "Forbidden", 403
     time = int(request.form.get("days", "3"));
-    if time not in times[request.host]:
+    if time not in times.per_host:
         return "Error, invalid length", 500
     db = get_db()
     with db.xact():
@@ -175,29 +195,47 @@ def put_motion():
         sr = s(cat, request.host)
         ident=""
         if len(sr) == 0 or sr[0][0] is None:
-            ident=prefix[request.host][cat]+"."+t.strftime("%Y%m%d")+".001"
+            ident=prefix.per_host[cat]+"."+t.strftime("%Y%m%d")+".001"
         else:
-            ident=prefix[request.host][cat]+"."+t.strftime("%Y%m%d")+"."+("%03d" % (int(sr[0][0].split(".")[2])+1))
+            ident=prefix.per_host[cat]+"."+t.strftime("%Y%m%d")+"."+("%03d" % (int(sr[0][0].split(".")[2])+1))
         p = db.prepare("INSERT INTO motion(\"name\", \"content\", \"deadline\", \"posed_by\", \"type\", \"identifier\", \"host\") VALUES($1, $2, CURRENT_TIMESTAMP + $3 * interval '1 days', $4, $5, $6, $7)")
         p(request.form.get("title", ""), request.form.get("content",""), time, g.voter, cat, ident, request.host)
     return rel_redirect("/")
 
 def motion_edited(motion):
     return rel_redirect("/?start=" + str(motion) + "#motion-" + str(motion))
+    
 
-@app.route("/motion/<string:motion>/cancel", methods=['POST'])
-def cancel_motion(motion):
-    rv = get_db().prepare("SELECT id, type FROM motion WHERE identifier=$1 AND host=$2")(motion, request.host);
+def validate_access(data):
+    rv = get_db().prepare("SELECT id, type, deadline, canceled FROM motion WHERE identifier=$1 AND host=$2")(data[0], data[1]);
     if len(rv) == 0:
         return "Error, Not found", 404
     id = rv[0].get("id")
-    if not may("cancel", rv[0].get("type")):
+    if not may(data[2], rv[0].get("type")):
         return "Forbidden", 403
+    if rv[0].get("deadline") < datetime.now() or rv[0].get("canceled") is not None:
+        return "Error, out of time", 403
+    return id
+
+    
+@app.route("/motion/<string:motion>/cancel", methods=['POST'])
+def cancel_motion(motion):
+    id = validate_access([motion, request.host, 'cancel'])
+    if not isinstance(id, int):
+        return id[0], id[1]
     if request.form.get("reason", "none") == "none":
         return "Error, form requires reason", 500
     rv = get_db().prepare("UPDATE motion SET canceled=CURRENT_TIMESTAMP, cancelation_reason=$1, canceled_by=$2 WHERE identifier=$3 AND host=$4 AND canceled is NULL")(request.form.get("reason", ""), g.voter, motion, request.host)
     return motion_edited(id)
 
+@app.route("/motion/<string:motion>/finish", methods=['POST'])
+def finish_motion(motion):
+    id = validate_access([motion, request.host, 'finish'])
+    if not isinstance(id, int):
+        return id[0], id[1]
+    rv = get_db().prepare("UPDATE motion SET deadline=CURRENT_TIMESTAMP WHERE identifier=$1 AND host=$2 AND canceled is NULL")(motion, request.host)
+    return motion_edited(id)
+
 @app.route("/motion/<string:motion>")
 def show_motion(motion):
     p = get_db().prepare("SELECT motion.*, poser.email AS poser, canceler.email AS canceler, (motion.deadline > CURRENT_TIMESTAMP AND canceled is NULL) AS running, vote.result FROM motion "\
@@ -206,10 +244,12 @@ def show_motion(motion):
                          + "LEFT JOIN voter canceler ON canceler.id = motion.canceled_by "
                          + "WHERE motion.identifier=$1 AND motion.host=$3")
     rv = p(motion, g.voter, request.host)
+    if len(rv) == 0:
+        return "Error, Not found", 404
     votes = None
     if may("audit", rv[0].get("type")) and not rv[0].get("running") and not rv[0].get("canceled"):
         votes = get_db().prepare("SELECT vote.result, voter.email FROM vote INNER JOIN voter ON voter.id = vote.voter_id WHERE vote.motion_id=$1")(rv[0].get("id"));
-    return render_template('single_motion.html', motion=rv[0], may_vote=may("vote", rv[0].get("type")), may_cancel=may("cancel", rv[0].get("type")), votes=votes)
+    return render_template('single_motion.html', motion=rv[0], may_vote=may("vote", rv[0].get("type")), may_cancel=may("cancel", rv[0].get("type")), may_finish=may("finish", rv[0].get("type")), votes=votes, singlemotion=True)
 
 @app.route("/motion/<string:motion>/vote", methods=['POST'])
 def vote(motion):