By {{ snippet.author.name }}
filed in {{ snippet.category.name }}
- {% if snippet.author == g.user %}
+ {% if snippet.author == g.user or g.user.is_admin %}
(edit)
{% endif %}
{{ snippet.rendered_body }}
diff --git a/flask_website/utils.py b/flask_website/utils.py
index b5bfecdd..eacdb77f 100644
--- a/flask_website/utils.py
+++ b/flask_website/utils.py
@@ -7,7 +7,7 @@ from pygments import highlight
from pygments.formatters import HtmlFormatter
from pygments.lexers import get_lexer_by_name
from pygments.util import ClassNotFound
-from flask import g, url_for, flash, request, redirect, Markup
+from flask import g, url_for, flash, abort, request, redirect, Markup
from flask_website.flaskystyle import FlaskyStyle # same as docs
from flask_website.database import User
@@ -85,3 +85,12 @@ def requires_login(f):
return redirect(url_for('general.login', next=request.path))
return f(*args, **kwargs)
return decorated_function
+
+
+def requires_admin(f):
+ @wraps(f)
+ def decorated_function(*args, **kwargs):
+ if not g.user.is_admin:
+ abort(401)
+ return f(*args, **kwargs)
+ return requires_login(decorated_function)
diff --git a/flask_website/views/extensions.py b/flask_website/views/extensions.py
index d613b22a..2a5cdb50 100644
--- a/flask_website/views/extensions.py
+++ b/flask_website/views/extensions.py
@@ -46,6 +46,32 @@ database = [
''',
bitbucket='leafstorm/flask-xml-rpc',
docs='http://packages.python.org/Flask-XML-RPC/'
+ ),
+ Extension('flask-csrf', 'Steve Losh',
+ description='''
+
A small Flask extension for adding
+ CSRF protection.
+ ''',
+ docs='http://sjl.bitbucket.org/flask-csrf/',
+ bitbucket='sjl/flask-csrf'
+ ),
+ Extension('flask-lesscss', 'Steve Losh',
+ description='''
+
+ A small Flask extension that makes it easy to use
+ LessCSS with your
+ Flask application.
+ ''',
+ docs='http://sjl.bitbucket.org/flask-lesscss/',
+ bitbucket='sjl/flask-lesscss'
+ ),
+ Extension('flask-urls', 'Steve Losh',
+ description='''
+
+ A collection of URL-related functions for Flask applications.
+ ''',
+ docs='http://sjl.bitbucket.org/flask-urls/',
+ bitbucket='sjl/flask-urls'
)
]
database.sort(key=lambda x: x.name.lower())
diff --git a/flask_website/views/general.py b/flask_website/views/general.py
index a32b1fea..7854d8d2 100644
--- a/flask_website/views/general.py
+++ b/flask_website/views/general.py
@@ -1,6 +1,6 @@
from flask import Module, render_template, session, redirect, url_for, \
request, flash, g, Response
-from flask_website import openid_auth
+from flask_website import oid
from flask_website.database import db_session, User
general = Module(__name__)
@@ -20,17 +20,30 @@ def logout():
@general.route('/login/', methods=['GET', 'POST'])
+@oid.loginhandler
def login():
if g.user is not None:
return redirect(url_for('general.index'))
- rv = openid_auth.check_return_from_provider()
- if rv is not None:
- return rv
if request.method == 'POST':
openid = request.values.get('openid')
if openid:
- return openid_auth.login(openid)
- return render_template('general/login.html')
+ return oid.try_login(openid, ask_for=['fullname', 'nickname'])
+ error = oid.fetch_error()
+ if error:
+ flash(u'Error: ' + error)
+ return render_template('general/login.html', next=oid.get_next_url())
+
+
+@oid.after_login
+def create_or_login(resp):
+ session['openid'] = resp.identity_url
+ user = User.query.filter_by(openid=resp.identity_url).first()
+ if user is not None:
+ flash(u'Successfully signed in')
+ g.user = user
+ return redirect(oid.get_next_url())
+ return redirect(url_for('first_login', next=oid.get_next_url(),
+ name=resp.fullname or resp.nickname))
@general.route('/first-login/', methods=['GET', 'POST'])
@@ -45,6 +58,7 @@ def first_login():
db_session.add(User(request.form['name'], session['openid']))
db_session.commit()
flash(u'Successfully created profile and logged in')
- return openid_auth.redirect_back()
+ return redirect(oid.get_next_url())
return render_template('general/first_login.html',
+ next=oid.get_next_url(),
openid=session['openid'])
diff --git a/flask_website/views/snippets.py b/flask_website/views/snippets.py
index 782ecf7c..4ee9da03 100644
--- a/flask_website/views/snippets.py
+++ b/flask_website/views/snippets.py
@@ -3,7 +3,7 @@ from urlparse import urljoin
from flask import Module, render_template, request, flash, abort, redirect, \
g, url_for
from werkzeug.contrib.atom import AtomFeed
-from flask_website.utils import requires_login, format_creole
+from flask_website.utils import requires_login, requires_admin, format_creole
from flask_website.database import Category, Snippet, Comment, db_session
snippets = Module(__name__, url_prefix='/snippets')
@@ -71,7 +71,7 @@ def edit(id):
snippet = Snippet.query.get(id)
if snippet is None:
abort(404)
- if snippet.author != g.user:
+ if g.user is None or (not g.user.is_admin and snippet.author != g.user):
abort(401)
preview = None
form = dict(title=snippet.title, body=snippet.body,
@@ -117,6 +117,64 @@ def category(slug):
snippets=snippets)
+@snippets.route('/manage-categories/', methods=['GET', 'POST'])
+@requires_admin
+def manage_categories():
+ categories = Category.query.order_by(Category.name).all()
+ if request.method == 'POST':
+ for category in categories:
+ category.name = request.form['name.%d' % category.id]
+ category.slug = request.form['slug.%d' % category.id]
+ db_session.commit()
+ flash(u'Categories updated')
+ return redirect(url_for('manage_categories'))
+ return render_template('snippets/manage_categories.html',
+ categories=categories)
+
+
+@snippets.route('/new-category/', methods=['POST'])
+@requires_admin
+def new_category():
+ category = Category(name=request.form['name'])
+ db_session.add(category)
+ db_session.commit()
+ flash(u'Category %s created.' % category.name)
+ return redirect(url_for('manage_categories'))
+
+
+@snippets.route('/delete-category//', methods=['GET', 'POST'])
+@requires_admin
+def delete_category(id):
+ category = Category.query.get(id)
+ if category is None:
+ abort(404)
+ if request.method == 'POST':
+ if 'cancel' in request.form:
+ flash(u'Deletion was aborted')
+ return redirect(url_for('manage_categories'))
+ move_to_id = request.form.get('move_to', type=int)
+ if move_to_id:
+ move_to = Category.query.get(move_to_id)
+ if move_to is None:
+ flash(u'Category was removed in the meantime')
+ else:
+ for snippet in category.snippets.all():
+ snippet.category = move_to
+ db_session.delete(category)
+ flash(u'Category %s deleted and entries moved to %s.' %
+ (category.name, move_to.name))
+ else:
+ category.snippets.delete()
+ db_session.delete(category)
+ flash(u'Category %s deleted' % category.name)
+ db_session.commit()
+ return redirect(url_for('manage_categories'))
+ return render_template('snippets/delete_category.html',
+ category=category,
+ other_categories=Category.query
+ .filter(Category.id != category.id).all())
+
+
@snippets.route('/recent.atom')
def recent_feed():
feed = AtomFeed(u'Recent Flask Snippets',
diff --git a/websiteconfig.py b/websiteconfig.py
index 37ee8ad7..1c78c9c7 100644
--- a/websiteconfig.py
+++ b/websiteconfig.py
@@ -6,6 +6,7 @@ DEBUG = False
SECRET_KEY = 'testkey'
DATABASE_URI = 'sqlite:///' + os.path.join(_basedir, 'flask-website.db')
+ADMINS = frozenset(['http://lucumr.pocoo.org/'])
THREADS_PER_PAGE = 15
MAILINGLIST_PATH = os.path.join(_basedir, '_mailinglist')