(https:.*?\.(mp4|webm))
', sanitized): - sanitized = sanitized.replace(i.group(0), f'') + for i in re.finditer('>(https://.*?\.(mp4|webm|mov))
', sanitized): + sanitized = sanitized.replace(f'', f'') for rd in ["https://reddit.com/", "https://new.reddit.com/", "https://www.reddit.com/", "https://redd.it/"]: sanitized = sanitized.replace(rd, "https://old.reddit.com/") diff --git a/files/helpers/wrappers.py b/files/helpers/wrappers.py index fe7c3073bc..2dece7a26d 100644 --- a/files/helpers/wrappers.py +++ b/files/helpers/wrappers.py @@ -18,8 +18,7 @@ def get_logged_in_user(): nonce = session.get("login_nonce", 0) logged_in = session.get("logged_in") - if not uid: return None - # if not uid or not logged_in or uid != logged_in: return None + if not uid or not logged_in or uid != logged_in: return None try: if g.db: v = g.db.query(User).filter_by(id=uid).first() diff --git a/files/routes/comments.py b/files/routes/comments.py index fd17f19340..f6866813fc 100644 --- a/files/routes/comments.py +++ b/files/routes/comments.py @@ -10,10 +10,12 @@ from pusher_push_notifications import PushNotifications from flask import * from files.__main__ import app, limiter from files.helpers.sanitize import filter_emojis_only +import requests site = environ.get("DOMAIN").strip() if site == 'pcmemes.net': cc = "SPLASH MOUNTAIN" else: cc = "COUNTRY CLUB" +CATBOX_KEY = environ.get("CATBOX_KEY").strip() beams_client = PushNotifications( instance_id=PUSHER_INSTANCE_ID, @@ -190,13 +192,17 @@ def api_comment(v): if request.files.get("file") and request.headers.get("cf-ipcountry") != "T1": file=request.files["file"] - if not file.content_type.startswith('image/'): return {"error": "That wasn't an image!"}, 400 - - name = f'/images/{time.time()}'.replace('.','')[:-5] + '.webp' - file.save(name) - url = process_image(name) - - body += f"\n\n" + if file.content_type.startswith('image/'): + name = f'/images/{time.time()}'.replace('.','')[:-5] + '.webp' + file.save(name) + url = process_image(name) + body += f"\n\n" + elif file.content_type.startswith('video/'): + file.save("video.mp4") + with open("video.mp4", 'rb') as f: + url = requests.request("POST", "https://api.imgur.com/3/upload", headers={'Authorization': f'Client-ID {CATBOX_KEY}'}, files=[('video', f)]).json()['data']['link'] + body += f"\n\n{url}" + else: return {"error": f"Image/Video files only"}, 400 if v.agendaposter and not v.marseyawarded: for k, l in AJ_REPLACEMENTS.items(): body = body.replace(k, l) @@ -720,13 +726,18 @@ def edit_comment(cid, v): if request.files.get("file") and request.headers.get("cf-ipcountry") != "T1": file=request.files["file"] - if not file.content_type.startswith('image/'): return {"error": "That wasn't an image!"}, 400 + if file.content_type.startswith('image/'): + name = f'/images/{time.time()}'.replace('.','')[:-5] + '.webp' + file.save(name) + url = process_image(name) + body += f"\n\n" + elif file.content_type.startswith('video/'): + file.save("video.mp4") + with open("video.mp4", 'rb') as f: + url = requests.request("POST", "https://api.imgur.com/3/upload", headers={'Authorization': f'Client-ID {CATBOX_KEY}'}, files=[('video', f)]).json()['data']['link'] + body += f"\n\n{url}" + else: return {"error": f"Image/Video files only"}, 400 - name = f'/images/{time.time()}'.replace('.','')[:-5] + '.webp' - file.save(name) - url = process_image(name) - - body += f"\n\n" body_md = CustomRenderer().render(mistletoe.Document(body)) body_html = sanitize(body_md) diff --git a/files/routes/front.py b/files/routes/front.py index 48a77c3c0a..8700fe6181 100644 --- a/files/routes/front.py +++ b/files/routes/front.py @@ -123,9 +123,6 @@ def notifications(v): @auth_desired def front_all(v): - if request.host == 'old.rdrama.net' and not (v and (v.admin_level or v.patron)): - return render_template("home.html", v=v, listing=[], next_exists=False, sort='hot', t='all', page=1) - if not v and request.path == "/" and not request.headers.get("Authorization"): return redirect(f"/logged_out{request.full_path}") if v and v.is_banned and not v.unban_utc: return render_template('errors/500.html', error=True, v=v), 500 diff --git a/files/routes/posts.py b/files/routes/posts.py index 5e9a49afa7..6d51ecc918 100644 --- a/files/routes/posts.py +++ b/files/routes/posts.py @@ -18,6 +18,7 @@ from PIL import Image as PILimage from .front import frontlist, changeloglist from urllib.parse import ParseResult, urlunparse, urlparse, quote from os import path +import requests site = environ.get("DOMAIN").strip() site_name = environ.get("SITE_NAME").strip() @@ -420,13 +421,17 @@ def edit_post(pid, v): if request.files.get("file") and request.headers.get("cf-ipcountry") != "T1": file=request.files["file"] - if not file.content_type.startswith('image/'): return {"error": "That wasn't an image!"}, 400 - - name = f'/images/{time.time()}'.replace('.','')[:-5] + '.webp' - file.save(name) - url = process_image(name) - - body += f"\n\n" + if file.content_type.startswith('image/'): + name = f'/images/{time.time()}'.replace('.','')[:-5] + '.webp' + file.save(name) + url = process_image(name) + body += f"\n\n" + elif file.content_type.startswith('video/'): + file.save("video.mp4") + with open("video.mp4", 'rb') as f: + url = requests.request("POST", "https://api.imgur.com/3/upload", headers={'Authorization': f'Client-ID {CATBOX_KEY}'}, files=[('video', f)]).json()['data']['link'] + body += f"\n\n{url}" + else: return {"error": f"Image/Video files only"}, 400 if body != p.body: for i in re.finditer('^(https:\/\/.*\.(png|jpg|jpeg|gif|webp|PNG|JPG|JPEG|GIF|WEBP|9999))', body, re.MULTILINE): @@ -743,7 +748,7 @@ def submit_post(v): for rd in ["https://reddit.com/", "https://new.reddit.com/", "https://www.reddit.com/", "https://redd.it/"]: url = url.replace(rd, "https://old.reddit.com/") - url = url.replace("old.reddit.com/gallery", "new.reddit.com/gallery").replace("https://youtu.be/", "https://youtube.com/watch?v=").replace("https://music.youtube.com/watch?v=", "https://youtube.com/watch?v=").replace("https://open.spotify.com/", "https://open.spotify.com/embed/").replace("https://streamable.com/", "https://streamable.com/e/").replace("https://youtube.com/shorts/", "https://youtube.com/watch?v=").replace("https://mobile.twitter", "https://twitter").replace("https://m.facebook", "https://facebook").replace("https://m.wikipedia", "https://wikipedia").replace("https://m.youtube", "https://youtube").replace("https://www.youtube", "https://youtube") + url = url.replace("old.reddit.com/gallery", "new.reddit.com/gallery").replace("https://youtu.be/", "https://youtube.com/watch?v=").replace("https://music.youtube.com/watch?v=", "https://youtube.com/watch?v=").replace("https://open.spotify.com/", "https://open.spotify.com/embed/").replace("https://streamable.com/", "https://streamable.com/e/").replace("https://youtube.com/shorts/", "https://youtube.com/watch?v=").replace("https://mobile.twitter", "https://twitter").replace("https://m.facebook", "https://facebook").replace("m.wikipedia.org", "wikipedia.org").replace("https://m.youtube", "https://youtube").replace("https://www.youtube", "https://youtube") if url.startswith("https://streamable.com/") and not url.startswith("https://streamable.com/e/"): url = url.replace("https://streamable.com/", "https://streamable.com/e/") @@ -916,13 +921,18 @@ def submit_post(v): if request.files.get("file2") and request.headers.get("cf-ipcountry") != "T1": file=request.files["file2"] - if not file.content_type.startswith('image/'): return {"error": "That wasn't an image!"}, 400 - - name = f'/images/{time.time()}'.replace('.','')[:-5] + '.webp' - file.save(name) - url = process_image(name) - - body += f"\n\n" + if file.content_type.startswith('image/'): + name = f'/images/{time.time()}'.replace('.','')[:-5] + '.webp' + file.save(name) + body += f"\n\n" + elif file.content_type.startswith('video/'): + file.save("video.mp4") + with open("video.mp4", 'rb') as f: + url = requests.request("POST", "https://api.imgur.com/3/upload", headers={'Authorization': f'Client-ID {CATBOX_KEY}'}, files=[('video', f)]).json()['data']['link'] + body += f"\n\n{url}" + else: + if request.headers.get("Authorization"): return {"error": f"Image/Video files only"}, 400 + else: return render_template("submit.html", v=v, error=f"Image/Video files only."), 400 body_html = sanitize(CustomRenderer().render(mistletoe.Document(body))) @@ -1003,20 +1013,6 @@ def submit_post(v): if request.headers.get("Authorization"): return {"error": f"File type not allowed"}, 400 else: return render_template("submit.html", v=v, error=f"File type not allowed.", title=title, body=request.values.get("body", "")), 400 - if file.content_type.startswith('video/') and v.truecoins < app.config["VIDEO_COIN_REQUIREMENT"] and v.admin_level < 1: - if request.headers.get("Authorization"): - return { - "error": f"You need at least {app.config['VIDEO_COIN_REQUIREMENT']} coins to upload videos" - }, 403 - else: - return render_template( - "submit.html", - v=v, - error=f"You need at least {app.config['VIDEO_COIN_REQUIREMENT']} coins to upload videos.", - title=title, - body=request.values.get("body", "") - ), 403 - if file.content_type.startswith('image/'): name = f'/images/{time.time()}'.replace('.','')[:-5] + '.webp' file.save(name) @@ -1025,7 +1021,7 @@ def submit_post(v): elif file.content_type.startswith('video/'): file.save("video.mp4") with open("video.mp4", 'rb') as f: - new_post.url = requests.post('https://catbox.moe/user/api.php', timeout=5, data={'userhash':CATBOX_KEY, 'reqtype':'fileupload'}, files={'fileToUpload':f}).text + url = requests.request("POST", "https://api.imgur.com/3/upload", headers={'Authorization': f'Client-ID {CATBOX_KEY}'}, files=[('video', f)]).json()['data']['link'] g.db.add(new_post) diff --git a/files/routes/settings.py b/files/routes/settings.py index e8a4caac7e..f57adcbaac 100644 --- a/files/routes/settings.py +++ b/files/routes/settings.py @@ -22,6 +22,7 @@ YOUTUBE_KEY = environ.get("YOUTUBE_KEY", "").strip() COINS_NAME = environ.get("COINS_NAME").strip() GUMROAD_TOKEN = environ.get("GUMROAD_TOKEN", "").strip() SITE_NAME = environ.get("SITE_NAME", "").strip() +CATBOX_KEY = environ.get("CATBOX_KEY").strip() tiers={ "(Paypig)": 1, @@ -116,50 +117,6 @@ def settings_profile_post(v): updated = True v.is_nofollow = request.values.get("nofollow", None) == 'true' - elif request.values.get("bio") or request.files.get('file') and request.headers.get("cf-ipcountry") != "T1": - bio = request.values.get("bio")[:1500] - - for i in re.finditer('^(https:\/\/.*\.(png|jpg|jpeg|gif|webp|PNG|JPG|JPEG|GIF|WEBP|9999))', bio, re.MULTILINE): - if "wikipedia" not in i.group(1): bio = bio.replace(i.group(1), f'})') - - if request.files.get('file'): - file = request.files['file'] - if not file.content_type.startswith('image/'): - if request.headers.get("Authorization"): return {"error": f"Image files only"}, 400 - else: return render_template("settings_profile.html", v=v, error=f"Image files only."), 400 - - name = f'/images/{time.time()}'.replace('.','')[:-5] + '.webp' - file.save(name) - url = process_image(name) - - bio += f"\n\n" - - bio_html = CustomRenderer().render(mistletoe.Document(bio)) - bio_html = sanitize(bio_html) - bans = filter_comment_html(bio_html) - - if bans: - ban = bans[0] - reason = f"Remove the {ban.domain} link from your bio and try again." - if ban.reason: - reason += f" {ban.reason}" - - return {"error": reason}, 401 - - if len(bio_html) > 10000: - return render_template("settings_profile.html", - v=v, - error="Your bio is too long") - - v.bio = bio[:1500] - v.bio_html=bio_html - g.db.add(v) - g.db.commit() - return render_template("settings_profile.html", - v=v, - msg="Your bio has been updated.") - - elif request.values.get("bio") == "": v.bio = None v.bio_html = None @@ -314,15 +271,19 @@ def settings_profile_post(v): if request.files.get('file'): file = request.files['file'] - if not file.content_type.startswith('image/'): - if request.headers.get("Authorization"): return {"error": f"Image files only"}, 400 - else: return render_template("settings_profile.html", v=v, error=f"Image files only."), 400 - - name = f'/images/{time.time()}'.replace('.','')[:-5] + '.webp' - file.save(name) - url = process_image(name) - - bio += f"\n\n" + if file.content_type.startswith('image/'): + name = f'/images/{time.time()}'.replace('.','')[:-5] + '.webp' + file.save(name) + url = process_image(name) + bio += f"\n\n" + elif file.content_type.startswith('video/'): + file.save("video.mp4") + with open("video.mp4", 'rb') as f: + url = requests.request("POST", "https://api.imgur.com/3/upload", headers={'Authorization': f'Client-ID {CATBOX_KEY}'}, files=[('video', f)]).json()['data']['link'] + bio += f"\n\n{url}" + else: + if request.headers.get("Authorization"): return {"error": f"Image/Video files only"}, 400 + else: return render_template("settings_profile.html", v=v, error=f"Image/Video files only."), 400 bio_html = CustomRenderer().render(mistletoe.Document(bio)) bio_html = sanitize(bio_html) diff --git a/files/templates/CHRISTMAS/authforms.html b/files/templates/CHRISTMAS/authforms.html index 22ef91814b..4ee91c18f5 100644 --- a/files/templates/CHRISTMAS/authforms.html +++ b/files/templates/CHRISTMAS/authforms.html @@ -14,11 +14,11 @@ {% if v %} - + {% if v.agendaposter %}{% elif v.css %}{% endif %} {% else %} - + {% endif %} diff --git a/files/templates/CHRISTMAS/comments.html b/files/templates/CHRISTMAS/comments.html index 2db8849a9a..89d4aa3df5 100644 --- a/files/templates/CHRISTMAS/comments.html +++ b/files/templates/CHRISTMAS/comments.html @@ -1,6 +1,6 @@ {% if v %} {% include "award_modal.html" %} - + {% endif %} diff --git a/files/templates/CHRISTMAS/comments/CommentEditForm.html b/files/templates/CHRISTMAS/comments/CommentEditForm.html index bfbfcecf54..1be38ccac4 100644 --- a/files/templates/CHRISTMAS/comments/CommentEditForm.html +++ b/files/templates/CHRISTMAS/comments/CommentEditForm.html @@ -34,7 +34,7 @@