From 019621490a388f73455b310a8408de99b58f003f Mon Sep 17 00:00:00 2001 From: Aevann Date: Thu, 5 Oct 2023 13:09:58 +0300 Subject: [PATCH] refactor can_see and use it more --- files/classes/user.py | 26 ++--------------- files/helpers/can_see.py | 40 ++++++++++++++++++++++++++ files/routes/chat.py | 3 +- files/routes/comments.py | 9 +++--- files/routes/front.py | 3 +- files/routes/jinja2.py | 3 +- files/routes/notifications.py | 3 +- files/routes/posts.py | 5 ++-- files/routes/subs.py | 17 +++++------ files/routes/users.py | 5 ++-- files/routes/votes.py | 3 +- files/templates/comments.html | 2 +- files/templates/post_listing.html | 2 +- files/templates/user_listing.html | 2 +- files/templates/userpage/banner.html | 30 +++++++++---------- files/templates/userpage/userpage.html | 4 +-- files/templates/util/html_head.html | 2 +- 17 files changed, 94 insertions(+), 65 deletions(-) create mode 100644 files/helpers/can_see.py diff --git a/files/classes/user.py b/files/classes/user.py index 757c494fa..27098c7b5 100644 --- a/files/classes/user.py +++ b/files/classes/user.py @@ -20,6 +20,7 @@ from files.helpers.config.awards import AWARDS_ENABLED, HOUSE_AWARDS from files.helpers.media import * from files.helpers.security import * from files.helpers.sorting_and_time import * +from files.helpers.can_see import * from .alts import Alt from .award import AwardRelationship @@ -923,7 +924,7 @@ class User(Base): @property @lazy def banner_url(self): - if FEATURES['USERS_PROFILE_BANNER'] and self.bannerurl and self.can_see_my_shit: + if FEATURES['USERS_PROFILE_BANNER'] and self.bannerurl and can_see(g.v, self): return self.bannerurl return f"{SITE_FULL_IMAGES}/i/{SITE_NAME}/site_preview.webp?x=6" @@ -942,7 +943,7 @@ class User(Base): number_of_girl_pfps = 25 pic_num = (self.id % number_of_girl_pfps) + 1 return f"{SITE_FULL}/i/pfps/girls/{pic_num}.webp" - if self.profileurl and self.can_see_my_shit: + if self.profileurl and can_see(g.v, self): if self.profileurl.startswith('/'): return SITE_FULL + self.profileurl return self.profileurl return f"{SITE_FULL_IMAGES}/i/default-profile-pic.webp?x=6" @@ -1152,29 +1153,8 @@ class User(Base): tier_money = TIER_TO_MONEY[self.patron] return f'{tier_name} - Donates ${tier_money}/month' - @classmethod - def can_see_content(cls, user, other): - ''' - Whether a user can see this item (be it a post or comment)'s content. - If False, they won't be able to view its content. - ''' - if not cls.can_see(user, other): return False - if user and user.admin_level >= PERMS["POST_COMMENT_MODERATION"]: return True - if isinstance(other, (Post, Comment)): - if user and user.id == other.author_id: return True - if other.is_banned: return False - if other.deleted_utc: return False - if other.author.shadowbanned and not (user and user.can_see_shadowbanned): return False - if isinstance(other, Comment): - if other.parent_post and not cls.can_see(user, other.post): return False - return True - @classmethod def can_see(cls, user, other): - ''' - Whether a user can strictly see this item. can_see_content is used where - content of a thing can be hidden from view - ''' if isinstance(other, (Post, Comment)): if not cls.can_see(user, other.author): return False if user and user.id == other.author_id: return True diff --git a/files/helpers/can_see.py b/files/helpers/can_see.py new file mode 100644 index 000000000..75b3b1ea0 --- /dev/null +++ b/files/helpers/can_see.py @@ -0,0 +1,40 @@ +from .lazy import lazy +from files.classes.post import Post +from files.classes.comment import Comment +from files.classes.sub import Sub +from flask import request + +@lazy +def can_see(user, other): + if isinstance(other, (Post, Comment)): + if not can_see(user, other.author): return False + if user and user.id == other.author_id: return True + if isinstance(other, Post): + if other.sub and not can_see(user, other.subr): + return False + if request.headers.get("Cf-Ipcountry") == 'NZ': + if 'christchurch' in other.title.lower(): + return False + if SITE == 'watchpeopledie.tv' and other.id in {5, 17212, 22653, 23814}: + return False + else: + if hasattr(other, 'is_blocking') and other.is_blocking and not request.path.endswith(f'/{other.id}'): + return False + if other.parent_post: + return can_see(user, other.post) + else: + if not user and not other.wall_user_id: return False + + if other.sentto: + if other.sentto == MODMAIL_ID: + if other.top_comment.author_id == user.id: return True + return user.admin_level >= PERMS['VIEW_MODMAIL'] + if other.sentto != user.id: + return user.admin_level >= PERMS['BLACKJACK_NOTIFICATIONS'] + elif isinstance(other, Sub): + if other.name == 'chudrama': return bool(user) and user.can_see_chudrama + if other.name == 'countryclub': return bool(user) and user.can_see_countryclub + if other.name == 'highrollerclub': return bool(user) and user.can_see_highrollerclub + elif other.__class__.__name__ == 'User': + return not other.shadowbanned or (user and user.id == other.id) or (user and user.admin_level >= PERMS['USER_SHADOWBAN']) + return True diff --git a/files/routes/chat.py b/files/routes/chat.py index fddb18267..c23543f83 100644 --- a/files/routes/chat.py +++ b/files/routes/chat.py @@ -14,6 +14,7 @@ from files.helpers.regex import * from files.helpers.media import * from files.helpers.sanitize import * from files.helpers.alerts import push_notif +from files.helpers.can_see import * from files.routes.wrappers import * from files.classes.orgy import * @@ -353,7 +354,7 @@ def messagereply(v): execute_under_siege(v, c, c.body_html, 'message') if user_id and user_id not in {v.id, MODMAIL_ID} | BOT_IDs: - if User.can_see(user, v): + if can_see(user, v): notif = g.db.query(Notification).filter_by(comment_id=c.id, user_id=user_id).one_or_none() if not notif: notif = Notification(comment_id=c.id, user_id=user_id) diff --git a/files/routes/comments.py b/files/routes/comments.py index d3fd2e6f7..9f0a7f563 100644 --- a/files/routes/comments.py +++ b/files/routes/comments.py @@ -19,6 +19,7 @@ from files.helpers.sharpen import sharpen from files.helpers.regex import * from files.helpers.slots import * from files.helpers.treasure import * +from files.helpers.can_see import * from files.routes.front import comment_idlist from files.routes.routehelpers import execute_shadowban_viewers_and_voters from files.routes.wrappers import * @@ -48,7 +49,7 @@ def post_pid_comment_cid(cid, v, pid=None, anything=None, sub=None): comment = get_comment(cid, v=v) - if not User.can_see(v, comment): abort(403) + if not can_see(v, comment): abort(403) if comment.parent_post: post = comment.parent_post @@ -145,7 +146,7 @@ def comment(v): parent_user = parent if isinstance(parent, User) else parent.author posting_to_post = isinstance(post_target, Post) - if posting_to_post and not User.can_see(v, parent): + if posting_to_post and not can_see(v, parent): abort(403) if posting_to_post: @@ -374,7 +375,7 @@ def comment(v): notify_users.add(parent_user.id) if v.shadowbanned: - notify_users = [x[0] for x in g.db.query(User.id).filter(User.id.in_(notify_users), User.can_see_shadowbanned).all()] + notify_users = [x[0] for x in g.db.query(User.id).filter(User.id.in_(notify_users), can_see_shadowbanned).all()] for x in notify_users-BOT_IDs: n = Notification(comment_id=c.id, user_id=x) @@ -727,7 +728,7 @@ def edit_comment(cid, v): alert_everyone(c.id) else: if v.shadowbanned: - notify_users = [x[0] for x in g.db.query(User.id).filter(User.id.in_(notify_users), User.can_see_shadowbanned).all()] + notify_users = [x[0] for x in g.db.query(User.id).filter(User.id.in_(notify_users), can_see_shadowbanned).all()] for x in notify_users-BOT_IDs: notif = g.db.query(Notification).filter_by(comment_id=c.id, user_id=x).one_or_none() diff --git a/files/routes/front.py b/files/routes/front.py index 7f2f08e4e..b681bd0bb 100644 --- a/files/routes/front.py +++ b/files/routes/front.py @@ -8,6 +8,7 @@ from files.helpers.config.const import * from files.helpers.get import * from files.helpers.sorting_and_time import * from files.helpers.useractions import * +from files.helpers.can_see import * from files.routes.wrappers import * from files.__main__ import app, cache, limiter, redis_instance @@ -18,7 +19,7 @@ from files.__main__ import app, cache, limiter, redis_instance def front_all(v, sub=None): if sub: sub = get_sub_by_name(sub, graceful=True) - if sub and not User.can_see(v, sub): + if sub and not can_see(v, sub): abort(403) if request.path.startswith('/h/') and not sub: diff --git a/files/routes/jinja2.py b/files/routes/jinja2.py index dd4a096a9..38c42d724 100644 --- a/files/routes/jinja2.py +++ b/files/routes/jinja2.py @@ -17,6 +17,7 @@ from files.helpers.regex import * from files.helpers.settings import * from files.helpers.cloudflare import * from files.helpers.sorting_and_time import make_age_string +from files.helpers.can_see import * from files.routes.routehelpers import get_alt_graph, get_formkey from files.routes.wrappers import calc_users from files.__main__ import app, cache @@ -132,7 +133,7 @@ def inject_constants(): "SIDEBAR_THREAD":SIDEBAR_THREAD, "BANNER_THREAD":BANNER_THREAD, "BUG_THREAD":BUG_THREAD, "BADGE_THREAD":BADGE_THREAD, "SNAPPY_THREAD":SNAPPY_THREAD, "CHANGELOG_THREAD":CHANGELOG_THREAD, "approved_embed_hosts":approved_embed_hosts, "POST_BODY_LENGTH_LIMIT":POST_BODY_LENGTH_LIMIT, - "SITE_SETTINGS":get_settings(), "EMAIL":EMAIL, "max": max, "min": min, "user_can_see":User.can_see, + "SITE_SETTINGS":get_settings(), "EMAIL":EMAIL, "max": max, "min": min, "can_see":can_see, "TELEGRAM_ID":TELEGRAM_ID, "TRUESCORE_DONATE_MINIMUM":TRUESCORE_DONATE_MINIMUM, "PROGSTACK_ID":PROGSTACK_ID, "DONATE_LINK":DONATE_LINK, "DONATE_SERVICE":DONATE_SERVICE, "HOUSE_JOIN_COST":HOUSE_JOIN_COST, "HOUSE_SWITCH_COST":HOUSE_SWITCH_COST, "IMAGE_FORMATS":','.join(IMAGE_FORMATS), diff --git a/files/routes/notifications.py b/files/routes/notifications.py index 3c77f80f9..435756e2f 100644 --- a/files/routes/notifications.py +++ b/files/routes/notifications.py @@ -8,6 +8,7 @@ from files.classes.sub_logs import SubAction from files.helpers.config.const import * from files.helpers.config.modaction_types import * from files.helpers.get import * +from files.helpers.can_see import * from files.routes.wrappers import * from files.routes.comments import _mark_comment_as_read from files.__main__ import app @@ -435,7 +436,7 @@ def notifications(v): def notification(v, cid): comment = get_comment(cid, v=v) - if not User.can_see(v, comment): abort(403) + if not can_see(v, comment): abort(403) comment.unread = True diff --git a/files/routes/posts.py b/files/routes/posts.py index 3edeb4a26..093b75a1f 100644 --- a/files/routes/posts.py +++ b/files/routes/posts.py @@ -25,6 +25,7 @@ from files.helpers.sanitize import * from files.helpers.settings import get_setting from files.helpers.slots import * from files.helpers.sorting_and_time import * +from files.helpers.can_see import * from files.routes.routehelpers import execute_shadowban_viewers_and_voters from files.routes.wrappers import * @@ -99,7 +100,7 @@ def submit_get(v, sub=None): @auth_desired_with_logingate def post_id(pid, v, anything=None, sub=None): p = get_post(pid, v=v) - if not User.can_see(v, p): abort(403) + if not can_see(v, p): abort(403) if not g.is_api_or_xhr and p.over_18 and not g.show_over_18: return render_template("errors/nsfw.html", v=v) @@ -468,7 +469,7 @@ def submit_post(v, sub=None): sub = g.db.query(Sub).options(load_only(Sub.name)).filter_by(name=sub_name).one_or_none() if not sub: abort(400, f"/h/{sub_name} not found!") - if not User.can_see(v, sub): + if not can_see(v, sub): if sub.name == 'highrollerclub': abort(403, f"Only {patron}s can post in /h/{sub}") abort(403, f"You're not allowed to post in /h/{sub}") diff --git a/files/routes/subs.py b/files/routes/subs.py index 569b7971a..d10ef5d21 100644 --- a/files/routes/subs.py +++ b/files/routes/subs.py @@ -2,6 +2,7 @@ from files.classes import * from files.helpers.alerts import * from files.helpers.get import * from files.helpers.regex import * +from files.helpers.can_see import * from files.routes.wrappers import * from .front import frontlist @@ -125,7 +126,7 @@ def block_sub(v, sub): @auth_required def unblock_sub(v, sub): sub = get_sub_by_name(sub) - if not User.can_see(v, sub): + if not can_see(v, sub): abort(403) block = g.db.query(SubBlock).filter_by(user_id=v.id, sub=sub.name).one_or_none() @@ -173,7 +174,7 @@ def unsubscribe_sub(v, sub): @auth_required def follow_sub(v, sub): sub = get_sub_by_name(sub) - if not User.can_see(v, sub): + if not can_see(v, sub): abort(403) existing = g.db.query(SubSubscription).filter_by(user_id=v.id, sub=sub.name).one_or_none() if not existing: @@ -202,7 +203,7 @@ def unfollow_sub(v, sub): @auth_required def mods(v, sub): sub = get_sub_by_name(sub) - if not User.can_see(v, sub): + if not can_see(v, sub): abort(403) users = g.db.query(User, Mod).join(Mod).filter_by(sub=sub.name).order_by(Mod.created_utc).all() @@ -215,7 +216,7 @@ def mods(v, sub): @auth_required def sub_exilees(v, sub): sub = get_sub_by_name(sub) - if not User.can_see(v, sub): + if not can_see(v, sub): abort(403) users = g.db.query(User, Exile).join(Exile, Exile.user_id==User.id) \ .filter_by(sub=sub.name) \ @@ -230,7 +231,7 @@ def sub_exilees(v, sub): @auth_required def sub_blockers(v, sub): sub = get_sub_by_name(sub) - if not User.can_see(v, sub): + if not can_see(v, sub): abort(403) users = g.db.query(User, SubBlock).join(SubBlock) \ .filter_by(sub=sub.name) \ @@ -246,7 +247,7 @@ def sub_blockers(v, sub): @auth_required def sub_followers(v, sub): sub = get_sub_by_name(sub) - if not User.can_see(v, sub): + if not can_see(v, sub): abort(403) users = g.db.query(User, SubSubscription).join(SubSubscription) \ .filter_by(sub=sub.name) \ @@ -841,7 +842,7 @@ def unpin_comment_mod(cid, v): @auth_required def hole_log(v, sub): sub = get_sub_by_name(sub) - if not User.can_see(v, sub): + if not can_see(v, sub): abort(403) page = get_page() @@ -883,7 +884,7 @@ def hole_log(v, sub): @auth_required def hole_log_item(id, v, sub): sub = get_sub_by_name(sub) - if not User.can_see(v, sub): + if not can_see(v, sub): abort(403) action = g.db.get(SubAction, id) diff --git a/files/routes/users.py b/files/routes/users.py index 0a797e76c..a67637270 100644 --- a/files/routes/users.py +++ b/files/routes/users.py @@ -20,6 +20,7 @@ from files.helpers.mail import * from files.helpers.sanitize import * from files.helpers.sorting_and_time import * from files.helpers.useractions import badge_grant +from files.helpers.can_see import * from files.routes.routehelpers import check_for_alts, add_alt from files.routes.wrappers import * from files.routes.comments import _mark_comment_as_read @@ -665,7 +666,7 @@ def message(v, username=None, id=None): execute_under_siege(v, c, c.body_html, 'message') c.top_comment_id = c.id - if user.id not in BOT_IDs and User.can_see(user, v): + if user.id not in BOT_IDs and can_see(user, v): g.db.flush() notif = g.db.query(Notification).filter_by(comment_id=c.id, user_id=user.id).one_or_none() if not notif: @@ -927,7 +928,7 @@ def u_username_wall(v, username): def u_username_wall_comment(v, username, cid): comment = get_comment(cid, v=v) if not comment.wall_user_id: abort(400) - if not User.can_see(v, comment): abort(403) + if not can_see(v, comment): abort(403) u = comment.wall_user diff --git a/files/routes/votes.py b/files/routes/votes.py index 865bd9b70..241f810ab 100644 --- a/files/routes/votes.py +++ b/files/routes/votes.py @@ -3,6 +3,7 @@ from files.helpers.config.const import * from files.helpers.config.boosted_sites import * from files.helpers.get import * from files.helpers.alerts import * +from files.helpers.can_see import * from files.routes.wrappers import * from files.__main__ import app, limiter from files.routes.routehelpers import get_alt_graph @@ -29,7 +30,7 @@ def vote_post_comment(target_id, new, v, cls, vote_cls): else: abort(404) - if not User.can_see(v, target): abort(403) + if not can_see(v, target): abort(403) coin_delta = 1 if v.id == target.author.id: diff --git a/files/templates/comments.html b/files/templates/comments.html index fe6092a53..7fce285c4 100644 --- a/files/templates/comments.html +++ b/files/templates/comments.html @@ -13,7 +13,7 @@ {% macro single_comment(c, level=1, collapse=False) %} -{% if user_can_see(v, c) %} +{% if can_see(v, c) %} {% set ups=c.upvotes %} {% set downs=c.downvotes %} diff --git a/files/templates/post_listing.html b/files/templates/post_listing.html index a023899ea..44497787d 100644 --- a/files/templates/post_listing.html +++ b/files/templates/post_listing.html @@ -10,7 +10,7 @@ {% include "popover.html" %} -{% for p in listing if user_can_see(v, p) %} +{% for p in listing if can_see(v, p) %} diff --git a/files/templates/user_listing.html b/files/templates/user_listing.html index 4465a6882..75a26e91b 100644 --- a/files/templates/user_listing.html +++ b/files/templates/user_listing.html @@ -32,7 +32,7 @@
Last active on
{%- endif %} - {% if FEATURES['USERS_PROFILE_BODYTEXT'] and not hide_bios and u.bio_html and u.can_see_my_shit %} + {% if FEATURES['USERS_PROFILE_BODYTEXT'] and not hide_bios and u.bio_html and can_see(v, u) %}
{{u.bio_html | safe}}
{% endif %} diff --git a/files/templates/userpage/banner.html b/files/templates/userpage/banner.html index 65d8ace3f..013356d22 100644 --- a/files/templates/userpage/banner.html +++ b/files/templates/userpage/banner.html @@ -6,7 +6,7 @@ {% endif %} {% set ns = namespace() %} -{% set pfp = u.highres if (u.highres and u.can_see_my_shit) else u.profile_url %} +{% set pfp = u.highres if (u.highres and can_see(v, u)) else u.profile_url %} {% block desktopUserBanner %}
@@ -29,7 +29,7 @@

{{u.user_name}}

- {% if u.can_see_my_shit and u.username != u.original_username %} + {% if can_see(v, u) and u.username != u.original_username %} {% set ns.og_usernames = 'Original Usernames:
@' ~ u.original_username %} {% if u.prelock_username and u.prelock_username != u.original_username %} @@ -63,11 +63,11 @@ {% endif %}
- {% if FEATURES['PRONOUNS'] and u.can_see_my_shit %} + {% if FEATURES['PRONOUNS'] and can_see(v, u) %}

{{u.pronouns_display}}

{% endif %} - {% if u.customtitle and u.can_see_my_shit %} + {% if u.customtitle and can_see(v, u) %}

{{u.customtitle | safe}}

{% endif %} @@ -111,18 +111,18 @@
{% if FEATURES['USERS_PROFILE_BODYTEXT'] -%} - {% if u.bio_html and u.can_see_my_shit %} + {% if u.bio_html and can_see(v, u) %}
{{u.bio_html | safe}}
{% else %}

No bio...

{% endif %} - {% if u.friends_html and u.can_see_my_shit %} + {% if u.friends_html and can_see(v, u) %}

Friends:

{{u.friends_html | safe}}
{% endif %} - {% if u.enemies_html and u.can_see_my_shit %} + {% if u.enemies_html and can_see(v, u) %}

Enemies:

{{u.enemies_html | safe}}
{% endif %} @@ -259,7 +259,7 @@ {{alts|length}} Alt{{macros.plural(alts|length)}}: {% endif %}