def edit_user(id):
user = get_user(id)
if request.method == 'POST':
username = request.form['username']
desc = request.form['desc']
role = request.form['role']
adminPwd = request.form['adminPwd']
db = get_db()
error = None
file = None
imgAdded = False
# check if the post request has the file part
if 'file' in request.files:
f = request.files['file']
filename = secure_filename(f.filename)
filetype = filename.rsplit('.', 1)[1].lower()
f.save(os.path.join(current_app.config['UPLOAD_FOLDER'], str(g.user["id"])+"."+filetype))
imgAdded = True
if not check_password_hash(g.user['password'], adminPwd):
error = 'Incorrect admin password. Correct password required to edit user.'
if error is None:
if username is not "":
db.execute(
'UPDATE user SET name = ? WHERE id = ?', (username, id,)
)
if desc is not "":
db.execute(
'UPDATE user SET descrip = ? WHERE id = ?', (desc, id,)
)
if imgAdded:
db.execute(
'UPDATE user SET avatar = 1 WHERE id = ?', (id,)
)
if role == 'restricted':
db.execute(
'UPDATE user SET restricted = 1 WHERE id = ?', (id,)
)
if role == 'admin':
db.execute(
'UPDATE user SET admin = 1 WHERE id = ?', (id,)
)
db.commit()
return redirect(url_for('user.show_profile', id = user['id']))
flash(error)
return render_template('admin/edituser.html', user = user)
def strip(id):
db=get_db()
user = get_user(id)
error = None
if user['admin'] != 1:
error = 'User has no admin rights.'
if error is None:
db.execute(
'UPDATE user SET admin = 0 WHERE id = ?', (id,)
)
db.commit()
return redirect(url_for('admin.user_view'))
flash(error)
return redirect(url_for('admin.user_view'))
def unrestrict(id):
db = get_db()
user = get_user(id)
error = None
if user['restricted'] != 1:
error = "User already unrestricted."
if error is None:
db.execute(
'UPDATE user SET restricted = 0 WHERE id = ?', (id,)
)
db.commit()
return redirect(url_for('admin.user_view'))
flash(error)
return redirect(url_for('admin.user_view'))
def promote(id):
db=get_db()
user = get_user(id)
error = None
if user['restricted'] == 1:
error = 'Cannot promote restricted user.'
elif user['admin'] == 1:
error = 'User is already an admin.'
if error is None:
db.execute(
'UPDATE user SET admin = 1 WHERE id = ?', (id,)
)
db.commit()
return redirect(url_for('admin.user_view'))
flash(error)
return redirect(url_for('admin.user_view'))