From a16fc6747596f97a42a71eff5e96e2f61f8c6a6d Mon Sep 17 00:00:00 2001
From: rebecca <ubq323@ubq323.website>
Date: Sat, 31 Oct 2026 18:53:16 +0000
Subject: add banning users

---
 apioforum/admin.py                   |  3 ++-
 apioforum/auth.py                    | 30 ++++++++++++++++--------------
 apioforum/db.py                      |  4 ++++
 apioforum/templates/admin/users.html |  3 ++-
 apioforum/templates/ban_user.html    | 14 ++++++++++++++
 apioforum/templates/view_user.html   |  5 +++++
 apioforum/user.py                    | 21 ++++++++++++++++++++-
 7 files changed, 63 insertions(+), 17 deletions(-)
 create mode 100644 apioforum/templates/ban_user.html

diff --git a/apioforum/admin.py b/apioforum/admin.py
index 7ad1d39..03f8b47 100644
--- a/apioforum/admin.py
+++ b/apioforum/admin.py
@@ -21,4 +21,5 @@ def user_list():
 		left outer join posts on posts.author = users.username
 		group by users.username
 		order by users.joined desc;""").fetchall()
-	return render_template("admin/users.html",users=users)
+	return render_template("admin/users.html",users=users,which="all apioforum users")
+
diff --git a/apioforum/auth.py b/apioforum/auth.py
index 8e939c0..0f2667c 100644
--- a/apioforum/auth.py
+++ b/apioforum/auth.py
@@ -90,23 +90,25 @@ def logout():
 
 @bp.before_app_request
 def load_user():
-	username = session.get("user")
 	if session.get("keep_logged_in",False):
 		session.permanent = True
-	if username is None:
-		g.user = None
-		g.user_info = None
+	g.user = None
+	g.user_info = None
+
+	username = session.get("user")
+	if username is None: return
+
+	row = get_db().execute(
+		"SELECT * FROM users WHERE username = ?;", (username,)
+	).fetchone()
+	if row is None: return # weird
+
+	if row['banned']:
+		session.clear()
+		flash("you have been banned from apioforum: "+row['banreason'] or "(no reason given)")
 	else:
-		row = get_db().execute(
-			"SELECT * FROM users WHERE username = ?;", (username,)
-		).fetchone()
-		if row is None:
-			g.user = None
-			g.user_info = None
-		else:
-			g.user = row['username']
-			g.user_info = row
-		
+		g.user = row['username']
+		g.user_info = row
 
 def login_required(view):
 	@functools.wraps(view)
diff --git a/apioforum/db.py b/apioforum/db.py
index ee197c6..116f136 100644
--- a/apioforum/db.py
+++ b/apioforum/db.py
@@ -254,6 +254,10 @@ CREATE VIEW most_recent_posts AS
 DROP VIEW public_posts;
 DROP VIEW public_forums;
 """,
+"""
+ALTER TABLE users ADD COLUMN banned INT NOT NULL DEFAULT 0;
+ALTER TABLE users ADD COLUMN banreason TEXT;
+""",
 ]
 
 
diff --git a/apioforum/templates/admin/users.html b/apioforum/templates/admin/users.html
index ed1eaf9..9949d63 100644
--- a/apioforum/templates/admin/users.html
+++ b/apioforum/templates/admin/users.html
@@ -7,7 +7,7 @@
 {% block content %}
 <h2>all users ({{ users | count }})</h2>
 <table>
-<tr><th>username</th><th>registered</th><th># posts</th></tr>
+<tr><th>username</th><th>registered</th><th># posts</th><th>banned?</th></tr>
 {% for user in users %}
 	<tr>
 		<td>{{disp_user(user.username)}}</td>
@@ -15,6 +15,7 @@
 			{{user.joined.strftime('%Y-%m-%d')}} {{ts(user.joined)}}
 			{% else %}antiquity{% endif %}</td>
 		<td>{{user.n_posts}}</td>
+		<td>{%if user.banned%}<b>BANNED:</b> {{user.banreason}}{%else%}<span style="color:lightgrey">no</span>{%endif%}</td>
 	</tr>
 {% endfor %}
 </table>
diff --git a/apioforum/templates/ban_user.html b/apioforum/templates/ban_user.html
new file mode 100644
index 0000000..4653d8f
--- /dev/null
+++ b/apioforum/templates/ban_user.html
@@ -0,0 +1,14 @@
+{% extends 'base.html' %}
+{% block header %}
+<h1>{%block title %}ban {{user.username|e}}{%endblock%}</h1>
+{% endblock %}
+
+{% block content %}
+<form method="post">
+<p>confirm banning user {{ disp_user(user.username) }}?</p>
+<label for="reason">ban reason (will be public)</label>
+<input type="text" name="reason" id="reason" placeholder="(no reason given)"><br>
+<input type="submit" value="confirm ban">
+<a href="{{url_for('user.view_user',username=user.username)}}">cancel</a>
+</form>
+{%endblock%}
diff --git a/apioforum/templates/view_user.html b/apioforum/templates/view_user.html
index aaa0c14..2235b5e 100644
--- a/apioforum/templates/view_user.html
+++ b/apioforum/templates/view_user.html
@@ -9,6 +9,11 @@
 	{% if g.user == user.username %}
 	<a class="actionbutton" href="{{url_for('user.edit_user',username=user.username)}}">settings</a>
 	{% endif %}
+	{% if user.banned %}
+	<span><b>BANNED:</b> {{ user.banreason or "(no reason given)" }}</span>
+	{%elif is_admin%}
+	<a class="actionbutton" href="{{url_for('user.ban_user',username=user.username)}}">ban user</a>
+	{% endif %}
 </div>
 <div class="user_info">
 	<div class="user_bio_quote">
diff --git a/apioforum/user.py b/apioforum/user.py
index a41707d..7220be9 100644
--- a/apioforum/user.py
+++ b/apioforum/user.py
@@ -8,6 +8,7 @@ from flask import (
 from werkzeug.security import check_password_hash, generate_password_hash
 from .db import get_db
 from .roles import has_permission
+from .permissions import admin_required
 import math
 
 bp = Blueprint("user", __name__, url_prefix="/user")
@@ -77,5 +78,23 @@ def edit_user(username):
 				flash(e)
 		else:
 			return redirect(url_for("user.view_user",username=username))
-		
+
 	return render_template("user_settings.html",user=user)
+
+@bp.route("/<username>/ban", methods=["GET","POST"])
+@admin_required
+def ban_user(username):
+	db = get_db()
+	user = db.execute("SELECT * FROM users WHERE username = ?",(username,)).fetchone()
+	if user is None:
+		abort(404)
+	if user['banned']:
+		flash("that user has already been banned")
+		return redirect(url_for('user.view_user',username=username))
+	if request.method == "POST":
+		reason = request.form.get("reason",None)
+		db.execute("update users set banned = 1, banreason = ? where username = ?",(reason,username))
+		db.commit()
+		flash("user banned succesfully")
+		return redirect(url_for("user.view_user",username=username))
+	return render_template("ban_user.html",user=user)
-- 
cgit v1.2.3