make template refuse to show posts that user does not have permission for

2 files changed, 41 insertions, 22 deletions

diff --git a/apioforum/__init__.py b/apioforum/__init__.py
index 2281fde..276568f 100644
--- a/apioforum/__init__.py
+++ b/apioforum/__init__.py
@@ -57,8 +57,10 @@ def create_app():
 	app.jinja_env.globals.update(forum_path=forum.forum_path)
 	app.jinja_env.globals.update(post_jump=thread.post_jump)
 	from .roles import has_permission, is_bureaucrat, get_user_role
+	from .thread import thread_info
 	app.jinja_env.globals.update(
 			has_permission=has_permission,
+			thread_info=thread_info,
 			is_bureaucrat=is_bureaucrat,
 			get_user_role=get_user_role)
 
diff --git a/apioforum/templates/common.html b/apioforum/templates/common.html
index 2a19b5c..935972d 100644
--- a/apioforum/templates/common.html
+++ b/apioforum/templates/common.html
@@ -3,26 +3,28 @@
 {%- endmacro %}
 
 {% macro disp_post(post, buttons=False, forum=None, footer=None) %}
+{% if not forum %}
+	{% if post.forum %}
+		{% set forum = post.forum %}
+	{% else %}
+		{% set forum = thread_info(post.thread).forum %}
+	{% endif %}
+{% endif %}
+{% if not has_permission(forum, g.user, "p_view_threads") %}
+	{{ hidden_post("you do not have permission to view this post.", post) }}
+{% elif post.deleted %}
+	{{ hidden_post("this post never existed.", post) }}
+{% else %}
 <div class="post {% if post.deleted %}deleted-post{% endif %}" id="post_{{post.id}}">
 	<div class="post-heading">
 		<span class="post-heading-a">
-			{% if not post.deleted %}
-				{{disp_user(post.author)}}
-			{% else %}
-				<span class="username">big brother</span>
-			{% endif %}
+			{{disp_user(post.author)}}
 
-			{% if forum != None %}
-				{% set role = get_user_role(forum, post.author) %}
-				{% if post.deleted %}
-					<span class="user-role">
-						(bureaucrat)
-					</span>
-				{% elif role != "other" %}
-					<span class="user-role">
-						({{ role }})
-					</span>
-				{% endif %}
+			{% set role = get_user_role(forum, post.author) %}
+			{% if role != "other" %}
+				<span class="user-role">
+					({{ role }})
+				</span>
 			{% endif %}
 
 			{{ts(post.created)}}
@@ -32,7 +34,7 @@
 			{% endif %}
 		</span>
 		<span class="post-heading-b">
-		{% if buttons and not post.deleted %}
+		{% if buttons %}
 			{% if post.author == g.user %}
 				<a class="actionbutton"
 				   href="{{url_for('thread.edit_post',post_id=post.id)}}">edit</a>
@@ -49,11 +51,7 @@
 		</span>
 	</div>
 	<div class="post-content md">
-		{% if not post.deleted %}
-			{{ post.content|md|safe }}
-		{% else %}
-			this post never existed.
-		{% endif %}
+		{{ post.content|md|safe }}
 	</div>
 	{% if footer %}
 	<div class="post-footer">
@@ -61,6 +59,25 @@
 	</div>
 	{% endif %}
 </div>
+{% endif %}
+{% endmacro %}
+
+{% macro hidden_post(message, post) %}
+<div class="post deleted-post" id="post_{{post.id}}">
+	<div class="post-heading">
+		<span class="post-heading-a">
+			<span class="username">big brother</span>
+			<span class="user-role">(bureaucrat)</span>
+			{{ts(post.created)}}
+		</span>
+		<span class="post-heading-b">
+		<a class="post-anchor-link" href="{{post_jump(post.id)}}">#{{post.id}}</a>
+		</span>
+	</div>
+	<div class="post-content md">
+		{{ message|md|safe }}
+	</div>
+</div>
 {% endmacro %}
 
 {% macro ts(dt) -%}