diff options
| -rw-r--r-- | apioforum/forum.py | 3 | ||||
| -rw-r--r-- | apioforum/user.py | 32 |
2 files changed, 18 insertions, 17 deletions
diff --git a/apioforum/forum.py b/apioforum/forum.py index 79bb3ee..3abe839 100644 --- a/apioforum/forum.py +++ b/apioforum/forum.py @@ -546,7 +546,7 @@ def search(): results = db.execute(""" SELECT posts.id, highlight(posts_fts, 0, '<mark>', '</mark>') AS content, posts.thread, posts.author, posts.created, posts.edited, - posts.updated, threads.title AS thread_title + posts.updated, threads.title AS thread_title, threads.forum FROM posts_fts JOIN posts ON posts_fts.rowid = posts.id JOIN threads ON threads.id = posts.thread @@ -559,6 +559,7 @@ def search(): print(e) flash('your search query was malformed.') return redirect(url_for("forum.not_actual_index")) + results = [p for p in results if has_permission(p['forum'], g.user, "p_view_threads")] display_thread_id = [ True ] * len(results) last_thread = None diff --git a/apioforum/user.py b/apioforum/user.py index cead2fe..a41707d 100644 --- a/apioforum/user.py +++ b/apioforum/user.py @@ -7,6 +7,7 @@ from flask import ( from werkzeug.security import check_password_hash, generate_password_hash from .db import get_db +from .roles import has_permission import math bp = Blueprint("user", __name__, url_prefix="/user") @@ -14,30 +15,29 @@ bp = Blueprint("user", __name__, url_prefix="/user") @bp.route("/<username>") @bp.route("/<username>/page/<int:page>") def view_user(username, page=1): - if page < 1: - abort(400) - db = get_db() user = db.execute("SELECT * FROM users WHERE username = ?;",(username,)).fetchone() - + + if page < 1: + abort(404) if user is None: abort(404) posts = db.execute(""" - SELECT * FROM posts - JOIN public_posts ON public_posts.id = posts.id - WHERE author = ? AND deleted = 0 AND public_posts.public - ORDER BY created DESC - LIMIT ? OFFSET ?;""",(username,POSTS_PER_PAGE,(page-1)*POSTS_PER_PAGE,)).fetchall() - num_posts = db.execute(""" - SELECT count(*) as count FROM posts - JOIN public_posts ON public_posts.id = posts.id - WHERE author = ? AND public_posts.public; - """,(username,)).fetchone()['count'] - max_pageno = math.ceil(num_posts/POSTS_PER_PAGE) + SELECT posts.*, threads.forum FROM posts + JOIN threads ON threads.id = posts.thread + WHERE author = ? AND deleted = 0 + ORDER BY created DESC;""",(username,)).fetchall() + posts = [p for p in posts if has_permission(p['forum'], g.user, "p_view_threads")] + max_pageno = math.ceil(len(posts)/POSTS_PER_PAGE) + if max_pageno > 0 and page > max_pageno: + abort(404) + + start = min((page-1)*POSTS_PER_PAGE, len(posts)) + end = min(start + POSTS_PER_PAGE, len(posts)) return render_template( "view_user.html", user=user, - posts=posts, + posts=posts[start:end], page=page, max_pageno=max_pageno, ) |