X-Git-Url: https://code.wpia.club/?a=blobdiff_plain;f=motion.py;h=1c83fc997a0460005b1947d9cb91e4b2831ba816;hb=0e21faff8279cf573c0483ff3be5092beef0e8e9;hp=ef98529fb19150a29245b13b522a1c68ff843ef0;hpb=301d8033d5489c65bde7df0f32013983647ff0da;p=motion.git

diff --git a/motion.py b/motion.py
index ef98529..1c83fc9 100644
--- a/motion.py
+++ b/motion.py
@@ -2,10 +2,12 @@ from flask import g
 from flask import Flask
 from flask import render_template, redirect
 from flask import request
+from functools import wraps
 import postgresql
 import filters
 from flaskext.markdown import Markdown
 from markdown.extensions import Extension
+from datetime import date, time, datetime
 
 def get_db():
     db = getattr(g, '_database', None)
@@ -63,7 +65,6 @@ def lookup_user():
         user = env.get("USER")
         roles = env.get("ROLES")
 
-
     if user is None:
         return "Server misconfigured", 500
     roles = roles.split(" ")
@@ -172,7 +173,7 @@ def main():
         else:
             prev = -1
     return render_template('index.html', motions=rv[:10], more=rv[10]["id"] if len(rv) == 11 else None, times=times.per_host, prev=prev,
-                           categories=get_allowed_cats("create"))
+                           categories=get_allowed_cats("create"), singlemotion=False)
 
 def rel_redirect(loc):
     r = redirect(loc)
@@ -203,20 +204,38 @@ def put_motion():
 
 def motion_edited(motion):
     return rel_redirect("/?start=" + str(motion) + "#motion-" + str(motion))
+    
 
-@app.route("/motion/<string:motion>/cancel", methods=['POST'])
-def cancel_motion(motion):
-    rv = get_db().prepare("SELECT id, type FROM motion WHERE identifier=$1 AND host=$2")(motion, request.host);
+def validate_access(data):
+    rv = get_db().prepare("SELECT id, type, deadline, canceled FROM motion WHERE identifier=$1 AND host=$2")(data[0], data[1]);
     if len(rv) == 0:
         return "Error, Not found", 404
     id = rv[0].get("id")
-    if not may("cancel", rv[0].get("type")):
+    if not may(data[2], rv[0].get("type")):
         return "Forbidden", 403
+    if rv[0].get("deadline") < datetime.now() or rv[0].get("canceled") is not None:
+        return "Error, out of time", 403
+    return id
+
+    
+@app.route("/motion/<string:motion>/cancel", methods=['POST'])
+def cancel_motion(motion):
+    id = validate_access([motion, request.host, 'cancel'])
+    if not isinstance(id, int):
+        return id[0], id[1]
     if request.form.get("reason", "none") == "none":
         return "Error, form requires reason", 500
     rv = get_db().prepare("UPDATE motion SET canceled=CURRENT_TIMESTAMP, cancelation_reason=$1, canceled_by=$2 WHERE identifier=$3 AND host=$4 AND canceled is NULL")(request.form.get("reason", ""), g.voter, motion, request.host)
     return motion_edited(id)
 
+@app.route("/motion/<string:motion>/finish", methods=['POST'])
+def finish_motion(motion):
+    id = validate_access([motion, request.host, 'finish'])
+    if not isinstance(id, int):
+        return id[0], id[1]
+    rv = get_db().prepare("UPDATE motion SET deadline=CURRENT_TIMESTAMP WHERE identifier=$1 AND host=$2 AND canceled is NULL")(motion, request.host)
+    return motion_edited(id)
+
 @app.route("/motion/<string:motion>")
 def show_motion(motion):
     p = get_db().prepare("SELECT motion.*, poser.email AS poser, canceler.email AS canceler, (motion.deadline > CURRENT_TIMESTAMP AND canceled is NULL) AS running, vote.result FROM motion "\
@@ -225,10 +244,12 @@ def show_motion(motion):
                          + "LEFT JOIN voter canceler ON canceler.id = motion.canceled_by "
                          + "WHERE motion.identifier=$1 AND motion.host=$3")
     rv = p(motion, g.voter, request.host)
+    if len(rv) == 0:
+        return "Error, Not found", 404
     votes = None
     if may("audit", rv[0].get("type")) and not rv[0].get("running") and not rv[0].get("canceled"):
         votes = get_db().prepare("SELECT vote.result, voter.email FROM vote INNER JOIN voter ON voter.id = vote.voter_id WHERE vote.motion_id=$1")(rv[0].get("id"));
-    return render_template('single_motion.html', motion=rv[0], may_vote=may("vote", rv[0].get("type")), may_cancel=may("cancel", rv[0].get("type")), votes=votes)
+    return render_template('single_motion.html', motion=rv[0], may_vote=may("vote", rv[0].get("type")), may_cancel=may("cancel", rv[0].get("type")), may_finish=may("finish", rv[0].get("type")), votes=votes, singlemotion=True)
 
 @app.route("/motion/<string:motion>/vote", methods=['POST'])
 def vote(motion):