def allow_checkpoint_delete(self, forum):
try:
forum_role = self.acl[forum.pk]
if forum_role['can_delete_checkpoints'] != 2:
raise ACLError403(_("You cannot delete checkpoints!"))
except KeyError:
raise ACLError403(_("You cannot delete checkpoints!"))
def allow_checkpoint_show(self, forum):
try:
forum_role = self.acl[forum.pk]
if not forum_role['can_delete_checkpoints']:
raise ACLError403(_("You cannot show checkpoints!"))
except KeyError:
raise ACLError403(_("You cannot show checkpoints!"))
def allow_post_votes_view(self, forum):
try:
forum_role = self.acl[forum.pk]
if not forum_role['can_see_votes']:
raise ACLError403(_("You don't have permission to see who voted on this post."))
except KeyError:
raise ACLError403(_("You don't have permission to see who voted on this post."))
def allow_cancel_warning(self, user, owner, warning):
if not self.acl['can_cancel_warnings']:
raise ACLError403(_("You can't cancel warnings."))
if warning.canceled:
raise ACLError403(_("This warning is already canceled."))
if not owner.is_warning_active(warning):
raise ACLError403(_("This warning is no longer in effect."))
try:
if (self.acl['can_cancel_warnings'] == 1
and user.id != warning.giver_id):
raise ACLError403(
_("You can't cancel other moderators warnings."))
except AttributeError:
pass
warning_age = timezone.now() - warning.given_on
warning_age = warning_age.seconds + warning_age.days * 86400
warning_age /= 60
if (self.acl['can_cancel_warnings_newer_than'] > 0
and self.acl['can_cancel_warnings_newer_than'] < warning_age):
raise ACLError403(_("This warning can no longer be canceled."))
def allow_post_downvote(self, forum):
try:
forum_role = self.acl[forum.pk]
if not forum_role['can_downvote_posts']:
raise ACLError403(_("You cannot downvote posts in this forum."))
except KeyError:
raise ACLError403(_("You cannot downvote posts in this forum."))
def allow_checkpoint_view(self, forum, checkpoint):
if checkpoint.deleted:
try:
forum_role = self.acl[forum.pk]
if not forum_role['can_see_deleted_checkpoints']:
raise ACLError403(_("Selected checkpoint could not be found."))
except KeyError:
raise ACLError403(_("Selected checkpoint could not be found."))
def allow_changelog_view(self, user, forum, post):
try:
forum_role = self.acl[forum.pk]
if post.thread.deleted or post.deleted:
self.allow_deleted_post_view(forum)
if not (forum_role['can_see_changelog'] or user.pk == post.user_id):
raise ACLError403(_("You don't have permission to see history of changes made to this post."))
except KeyError:
raise ACLError403(_("You don't have permission to see history of changes made to this post."))
def allow_new_threads(self, forum):
try:
forum_role = self.acl[forum.pk]
if forum_role['can_read_threads'] == 0 or forum_role['can_start_threads'] == 0:
raise ACLError403(_("You don't have permission to start new threads in this forum."))
if forum.closed and forum_role['can_close_threads'] == 0:
raise ACLError403(_("This forum is closed, you can't start new threads in it."))
except KeyError:
raise ACLError403(_("You don't have permission to start new threads in this forum."))
def allow_revert(self, forum, thread):
try:
forum_role = self.acl[forum.pk]
if not forum_role['can_close_threads']:
if forum.closed:
raise ACLError403(_("You can't make reverts in closed forums."))
if thread.closed:
raise ACLError403(_("You can't make reverts in closed threads."))
if not forum_role['can_edit_threads_posts']:
raise ACLError403(_("You don't have permission to make reverts in this forum."))
except KeyError:
raise ACLError403(_("You don't have permission to make reverts in this forum."))
def allow_reply(self, forum, thread):
try:
forum_role = self.acl[thread.forum.pk]
if forum_role['can_write_posts'] == 0:
raise ACLError403(_("You don't have permission to write replies in this forum."))
if forum_role['can_close_threads'] == 0:
if forum.closed:
raise ACLError403(_("You can't write replies in closed forums."))
if thread.closed:
raise ACLError403(_("You can't write replies in closed threads."))
except KeyError:
raise ACLError403(_("You don't have permission to write replies in this forum."))
def allow_thread_view(self, user, thread):
try:
forum_role = self.acl[thread.forum_id]
if forum_role['can_read_threads'] == 0:
raise ACLError403(_("You don't have permission to read threads in this forum."))
if forum_role['can_read_threads'] == 1 and thread.weight < 2 and thread.start_poster_id != user.id:
raise ACLError404()
if thread.moderated and not (forum_role['can_approve'] or (user.is_authenticated() and user == thread.start_poster)):
raise ACLError404()
if thread.deleted and not forum_role['can_delete_threads']:
raise ACLError404()
except KeyError:
raise ACLError403(_("You don't have permission to read threads in this forum."))
def set_context(self):
super(NewReplyView, self).set_context()
if not (self.request.acl.private_threads.is_mod()
or self.thread.participants.count() > 1):
raise ACLError403(
_("This thread needs to have more than one participant to allow new replies."
))
def make_jump(self):
target_user = int(self.request.POST.get('user', 0))
if (not (self.request.user.pk == self.thread.start_poster_id or
self.request.acl.private_threads.is_mod()) and
target_user != self.request.user.pk):
raise ACLError403(_("You don't have permission to remove discussion participants."))
try:
user = self.thread.participants.get(id=target_user)
self.thread.participants.remove(user)
self.thread.threadread_set.filter(id=user.pk).delete()
self.thread.watchedthread_set.filter(id=user.pk).delete()
user.sync_pds = True
user.save(force_update=True)
# If there are no more participants in thread, remove it
if self.thread.participants.count() == 0:
self.thread.delete()
messages.info(self.request, _('Thread has been deleted because last participant left it.'), 'threads')
return self.threads_list_redirect()
# Nope, see if we removed ourselves
if user.pk == self.request.user.pk:
self.thread.set_checkpoint(self.request, 'left')
messages.info(self.request, _('You have left the "%(thread)s" thread.') % {'thread': self.thread.name}, 'threads')
return self.threads_list_redirect()
# Nope, somebody else removed user
user.sync_pds = True
user.save(force_update=True)
self.thread.set_checkpoint(self.request, 'removed', user)
messages.info(self.request, _('Selected participant was removed from thread.'), 'threads')
return self.retreat_redirect()
except User.DoesNotExist:
messages.error(self.request, _('Requested thread participant does not exist.'), 'threads')
return self.retreat_redirect()
def allow_member_warns_view(self, user, other_user):
try:
if user.pk == other_user.pk:
return
except AttributeError:
pass
if not self.acl['can_see_other_members_warns']:
raise ACLError403(
_("You don't have permission to see this member warnings."))
def form_initial_data(self):
if self.kwargs.get('user'):
try:
user = User.objects.get(id=self.kwargs.get('user'))
acl = user.acl(self.request)
if not acl.private_threads.can_participate():
raise ACLError403(
_("This member can not participate in private threads."
))
if (not self.request.acl.private_threads.can_invite_ignoring()
and not user.allow_pd_invite(self.request.user)):
raise ACLError403(
_('%(user)s restricts who can invite him to private threads.'
) % {'user': user.username})
return {'invite_users': user.username}
except User.DoesNotExist:
raise ACLError404()
return {}
def set_context(self):
self.request.acl.threads.allow_delete_post(self.request.user,
self.forum, self.thread,
self.post)
acl = self.request.acl.threads.get_role(self.thread.forum_id)
if not acl['can_delete_posts'] and self.thread.post_set.filter(
id__gt=self.post.pk).count() > 0:
raise ACLError403(
_("Somebody has already replied to this post, you cannot delete it."
))
def allow_destroy_user(self, user):
if not (self.acl['can_destroy_user_newer_than']
or self.acl['can_destroy_users_with_less_posts_than']):
raise ACLError403(_("You can't destroy user accounts."))
if user.is_god() or user.is_team:
raise ACLError403(
_("This user account is protected and cannot be destroyed."))
if self.acl['can_destroy_user_newer_than']:
user_age = timezone.now() - user.join_date
if user_age.days > self.acl['can_destroy_user_newer_than']:
raise ACLError403(
_("You can't destroy this user account. It's too old."))
if (self.acl['can_destroy_users_with_less_posts_than'] and user.posts >
self.acl['can_destroy_users_with_less_posts_than']):
raise ACLError403(
_("You can't destroy this user account. Too many messages were posted from it."
))
def allow_forum_search(self, forum):
if forum.special == 'private_threads':
if not self.acl.private_threads.can_participate():
raise ACLError403()
if self.acl.private_threads.is_mod():
self._threads = [
t.pk for t in forum.thread_set.filter(
Q(participants__id=self.user.pk)
| Q(replies_reported__gt=0)).iterator()
]
else:
self._threads = [
t.pk for t in forum.thread_set.filter(
participants__id=self.user.pk).iterator()
]
elif forum.special == 'reports':
if not self.acl.reports.can_handle():
raise ACLError403()
self._forums = [forum.pk]
else:
self._forums = Forum.objects.readable_forums(self.acl)
def set_context(self):
self.request.acl.threads.allow_delete_thread(self.request.user,
self.proxy, self.thread,
self.thread.start_post)
# Assert we are not user trying to delete thread with replies
acl = self.request.acl.threads.get_role(self.thread.forum_id)
if not acl['can_delete_threads']:
if self.thread.post_set.exclude(
user_id=self.request.user.id).count() > 0:
raise ACLError403(
_("Somebody has already replied to this thread. You cannot delete it."
))
def __call__(self, request, **kwargs):
try:
if request.user.is_crawler():
raise ACLError404()
if not request.acl.search.can_search():
raise ACLError403(
_("You don't have permission to search community."))
self.request = request
return self.call(**kwargs)
except ACLError403 as e:
return error403(request, unicode(e))
except ACLError404 as e:
return error404(request, unicode(e))
def _upload_file(self, uploaded_file):
try:
self.request.acl.threads.allow_upload_attachments(self.forum)
attachments_limit = self.request.acl.threads.attachments_limit(
self.forum)
if attachments_limit != 0 and self.user_attachments >= attachments_limit:
raise ACLError403(
_("You can't attach any more files to this form."))
if not uploaded_file:
raise ValidationError(_("You have to upload file."))
Attachment.objects.allow_more_orphans()
attachment_type = AttachmentType.objects.find_type(
uploaded_file.name)
if not attachment_type:
raise ValidationError(_("This is not an allowed file type."))
attachment_type.allow_file_upload(
self.request.user,
self.request.acl.threads.attachment_size_limit(self.forum),
uploaded_file.size)
new_attachment = Attachment()
new_attachment.generate_hash_id(self.attachments_token)
new_attachment.session = self.attachments_token
new_attachment.filetype = attachment_type
new_attachment.user = self.request.user
new_attachment.user_name = self.request.user.username
new_attachment.user_name_slug = self.request.user.username_slug
new_attachment.ip = self.request.session.get_ip(self.request)
new_attachment.agent = self.request.META.get('HTTP_USER_AGENT')
new_attachment.use_file(uploaded_file)
new_attachment.save(force_insert=True)
self.session_attachments.append(new_attachment.pk)
self.request.session[
self.attachments_token] = self.session_attachments
self.attachments.insert(0, new_attachment)
self.message = Message(
_('File "%(filename)s" has been attached successfully.') %
{'filename': new_attachment.name})
except ACLError403 as e:
self.message = Message(unicode(e), messages.ERROR)
except ValidationError as e:
self.message = Message(unicode(e.messages[0]), messages.ERROR)
def __call__(self, request, **kwargs):
self.search_route = self.default_search_route
self.search_form = self.default_search_form
try:
self.request = request
if request.user.is_crawler():
raise ACLError404()
self.check_acl()
if not request.acl.search.can_search():
raise ACLError403(
_("You don't have permission to search community."))
if self.request.method == "POST":
return self.search(request)
return self.draw_form(request)
except ACLError403 as e:
return error403(request, unicode(e))
except ACLError404 as e:
return error404(request, unicode(e))
def __call__(self, request, **kwargs):
self.request = request
self.kwargs = kwargs
self.forum = None
self.thread = None
self.post = None
self.parents = []
try:
self._type_available()
self.fetch_target()
self._check_permissions()
if not request.user.is_authenticated():
raise ACLError403(
_("Guest, you have to sign-in in order to see posts changelogs."
))
except (Forum.DoesNotExist, Thread.DoesNotExist, Post.DoesNotExist,
Change.DoesNotExist):
return error404(self.request)
except ACLError403 as e:
return error403(request, e)
except ACLError404 as e:
return error404(request, e)
return self.dispatch(request)
def allow_delete_post(self, user, forum, thread, post, delete=False):
try:
forum_role = self.acl[forum.pk]
if not forum_role['can_close_threads']:
if forum.closed:
raise ACLError403(_("You don't have permission to delete posts in closed forum."))
if thread.closed:
raise ACLError403(_("This thread is closed, you cannot delete its posts."))
if post.protected and not forum_role['can_protect_posts'] and not forum_role['can_delete_posts']:
raise ACLError403(_("This post is protected, you cannot delete it."))
if not (forum_role['can_delete_posts'] == 2 or
(not delete and (forum_role['can_delete_posts'] == 1 or
(post.user_id == user.pk and forum_role['can_soft_delete_own_posts'])))):
raise ACLError403(_("You don't have permission to delete this post."))
if post.deleted and not delete:
raise ACLError403(_("This post is already deleted."))
except KeyError:
raise ACLError403(_("You don't have permission to delete this post."))
def allow_reply_edit(self, user, forum, thread, post):
try:
forum_role = self.acl[thread.forum_id]
if thread.deleted or post.deleted:
self.allow_deleted_post_view(forum)
if not forum_role['can_close_threads']:
if forum.closed:
raise ACLError403(_("You can't edit replies in closed forums."))
if thread.closed:
raise ACLError403(_("You can't edit replies in closed threads."))
if not forum_role['can_edit_threads_posts']:
if post.user_id != user.pk:
raise ACLError403(_("You can't edit other members replies."))
if not forum_role['can_edit_own_posts']:
raise ACLError403(_("You can't edit your replies."))
if post.protected:
raise ACLError403(_("This reply is protected, you cannot edit it."))
except KeyError:
raise ACLError403(_("You don't have permission to edit replies in this forum."))
def allow_warning(self):
if not self.acl['can_be_warned']:
raise ACLError403(_("This member can't be warned."))
def allow_warning_members(self):
if not self.acl['can_warn_members']:
raise ACLError403(_("You can't warn other members."))
def allow_delete_warning(self):
if not self.acl['can_delete_warnings']:
raise ACLError403(_("You can't delete user warnings."))
def set_context(self):
self.request.acl.threads.allow_checkpoint_hide(self.forum)
if self.checkpoint.deleted:
raise ACLError403(_('This checkpoint is already hidden!'))
def set_context(self):
self.request.acl.threads.allow_checkpoint_show(self.forum)
if not self.checkpoint.deleted:
raise ACLError403(_('This checkpoint is already visible!'))