Merge branch 'readme' into 'master'

[motion.git] / motion.py

diff --git a/motion.py b/motion.py
index 6da4a1e2790bd1694d99f5cc043d7ef475cd9856..df5db15b57e335e16a3cd4da5c0e6fc3edef779a 100644 (file)
--- a/motion.py
+++ b/motion.py
@@ -4,8 +4,8 @@ from flask import render_template, redirect
 from flask import request
 import postgresql
 import filters
-
-times=[3,5,14]
+from flaskext.markdown import Markdown
+from markdown.extensions import Extension
 
 def get_db():
     db = getattr(g, '_database', None)
@@ -17,10 +17,30 @@ def get_db():
 app = Flask(__name__)
 app.register_blueprint(filters.blueprint)
 
+class EscapeHtml(Extension):
+    def extendMarkdown(self, md, md_globals):
+        del md.preprocessors['html_block']
+        del md.inlinePatterns['html']
+
+md = Markdown(app, extensions=[EscapeHtml()])
+
 # Load config
 app.config.from_pyfile('config.py')
 
-prefix=app.config.get("GROUP_PREFIX")
+
+class ConfigProxy:
+    def __init__(self, name):
+        self.name = name
+    @property
+    def per_host(self):
+        dict = app.config.get(self.name)
+        if dict is None:
+            return None
+        return dict.get(request.host)
+
+prefix = ConfigProxy("GROUP_PREFIX")
+times = ConfigProxy("DURATION")
+debuguser = ConfigProxy("DEBUGUSER")
 
 @app.before_request
 def lookup_user():
@@ -28,6 +48,12 @@ def lookup_user():
 
     env = request.environ
     user = None
+    my_debuguser = debuguser.per_host
+    if my_debuguser is not None:
+        parts = my_debuguser.split("/", 1)
+        user = parts[0]
+        roles = parts[1]
+
     if "USER_ROLES" in env:
         parts = env.get("USER_ROLES").split("/", 1)
         user = parts[0]
@@ -37,6 +63,7 @@ def lookup_user():
         user = env.get("USER")
         roles = env.get("ROLES")
 
+
     if user is None:
         return "Server misconfigured", 500
     roles = roles.split(" ")
@@ -56,13 +83,14 @@ def lookup_user():
 
     for r in roles:
         a = r.split(":", 1)
-        val = a[1]
-        if a[0] not in g.roles:
-            g.roles[a[0]] = []
-        if val == "*":
-            g.roles[a[0]] = [group for group in prefix[request.host]]
-        else:
-            g.roles[a[0]].append(val)
+        if len(r)!=0:
+            val = a[1]
+            if a[0] not in g.roles:
+                g.roles[a[0]] = []
+            if val == "*":
+                g.roles[a[0]] = [group for group in prefix.per_host]
+            else:
+                g.roles[a[0]].append(val)
     return None
 
 def get_allowed_cats(action):
@@ -143,7 +171,7 @@ def main():
             prev = rs[9][0]
         else:
             prev = -1
-    return render_template('index.html', motions=rv[:10], more=rv[10]["id"] if len(rv) == 11 else None, times=times, prev=prev,
+    return render_template('index.html', motions=rv[:10], more=rv[10]["id"] if len(rv) == 11 else None, times=times.per_host, prev=prev,
                            categories=get_allowed_cats("create"))
 
 def rel_redirect(loc):
@@ -157,7 +185,7 @@ def put_motion():
     if cat not in get_allowed_cats("create"):
         return "Forbidden", 403
     time = int(request.form.get("days", "3"));
-    if time not in times:
+    if time not in times.per_host:
         return "Error, invalid length", 500
     db = get_db()
     with db.xact():
@@ -166,9 +194,9 @@ def put_motion():
         sr = s(cat, request.host)
         ident=""
         if len(sr) == 0 or sr[0][0] is None:
-            ident=prefix[request.host][cat]+"."+t.strftime("%Y%m%d")+".001"
+            ident=prefix.per_host[cat]+"."+t.strftime("%Y%m%d")+".001"
         else:
-            ident=prefix[request.host][cat]+"."+t.strftime("%Y%m%d")+"."+("%03d" % (int(sr[0][0].split(".")[2])+1))
+            ident=prefix.per_host[cat]+"."+t.strftime("%Y%m%d")+"."+("%03d" % (int(sr[0][0].split(".")[2])+1))
         p = db.prepare("INSERT INTO motion(\"name\", \"content\", \"deadline\", \"posed_by\", \"type\", \"identifier\", \"host\") VALUES($1, $2, CURRENT_TIMESTAMP + $3 * interval '1 days', $4, $5, $6, $7)")
         p(request.form.get("title", ""), request.form.get("content",""), time, g.voter, cat, ident, request.host)
     return rel_redirect("/")
@@ -178,7 +206,7 @@ def motion_edited(motion):
 
 @app.route("/motion/<string:motion>/cancel", methods=['POST'])
 def cancel_motion(motion):
-    rv = get_db().prepare("SELECT id, type FROM motion WHERE identifier=$1 AND request.host")(motion, request.host);
+    rv = get_db().prepare("SELECT id, type FROM motion WHERE identifier=$1 AND host=$2")(motion, request.host);
     if len(rv) == 0:
         return "Error, Not found", 404
     id = rv[0].get("id")
@@ -197,6 +225,8 @@ def show_motion(motion):
                          + "LEFT JOIN voter canceler ON canceler.id = motion.canceled_by "
                          + "WHERE motion.identifier=$1 AND motion.host=$3")
     rv = p(motion, g.voter, request.host)
+    if len(rv) == 0:
+        return "Error, Not found", 404
     votes = None
     if may("audit", rv[0].get("type")) and not rv[0].get("running") and not rv[0].get("canceled"):
         votes = get_db().prepare("SELECT vote.result, voter.email FROM vote INNER JOIN voter ON voter.id = vote.voter_id WHERE vote.motion_id=$1")(rv[0].get("id"));
@@ -207,7 +237,7 @@ def vote(motion):
     v = request.form.get("vote", "abstain")
     db = get_db()
     with db.xact():
-        rv = db.prepare("SELECT id, type FROM motion WHERE identifier=$1 AND host=$2")(motion, host);
+        rv = db.prepare("SELECT id, type FROM motion WHERE identifier=$1 AND host=$2")(motion, request.host);
         if len(rv) == 0:
             return "Error, Not found", 404
         if not may("vote", rv[0].get("type")):
@@ -216,8 +246,8 @@ def vote(motion):
         id = rv[0].get("id")
         if not p(motion, request.host)[0][0]:
             return "Error, motion deadline has passed", 500
-        p = db.prepare("SELECT * FROM vote WHERE motion_id = $1 AND voter_id = $2 AND host=$3")
-        rv = p(id, g.voter, request.host)
+        p = db.prepare("SELECT * FROM vote WHERE motion_id = $1 AND voter_id = $2")
+        rv = p(id, g.voter)
         if len(rv) == 0:
             db.prepare("INSERT INTO vote(motion_id, voter_id, result) VALUES($1,$2,$3)")(id, g.voter, v)
         else: