From c1703d8ac2d9c59ea4d257e6379b2ff8ac607f84 Mon Sep 17 00:00:00 2001
From: Aevann <randomname42029@gmail.com>
Date: Sat, 18 Nov 2023 13:51:09 +0200
Subject: [PATCH] hide patron badge owners for non-jannies

---
 files/helpers/config/const.py | 2 ++
 files/routes/static.py        | 4 +---
 files/routes/users.py         | 3 +++
 3 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/files/helpers/config/const.py b/files/helpers/config/const.py
index 6251682e4..e017d2d4b 100644
--- a/files/helpers/config/const.py
+++ b/files/helpers/config/const.py
@@ -578,6 +578,8 @@ LEADERBOARD_LIMIT = PAGE_SIZE
 HOUSE_JOIN_COST = 500
 HOUSE_SWITCH_COST = 2000
 
+PATRON_BADGES = {22,23,24,25,26,27,28,257,258,259,260,261}
+
 TIER_TO_NAME = {
 	1: "Beneficiary",
 	2: "Paypig",
diff --git a/files/routes/static.py b/files/routes/static.py
index a2457e5bf..c22077ebd 100644
--- a/files/routes/static.py
+++ b/files/routes/static.py
@@ -325,15 +325,13 @@ def submit_contact(v):
 
 	return {"message": "Your message has been sent to the admins!"}
 
-patron_badges = (22,23,24,25,26,27,28,257,258,259,260,261)
-
 @cache.memoize(timeout=3600)
 def badge_list(site, can_view_patron_badges):
 
 	badges = g.db.query(BadgeDef)
 
 	if not can_view_patron_badges:
-		badges = badges.filter(BadgeDef.id.notin_(patron_badges))
+		badges = badges.filter(BadgeDef.id.notin_(PATRON_BADGES))
 
 	badges = badges.order_by(BadgeDef.id).all()
 
diff --git a/files/routes/users.py b/files/routes/users.py
index ec233c2a5..de56ce3bf 100644
--- a/files/routes/users.py
+++ b/files/routes/users.py
@@ -1310,6 +1310,9 @@ def toggle_pins(hole, sort):
 @limiter.limit(DEFAULT_RATELIMIT, deduct_when=lambda response: response.status_code < 400, key_func=get_ID)
 @auth_required
 def bid_list(v, bid):
+	if bid in PATRON_BADGES and v.admin_level < PERMS['VIEW_PATRONS']:
+		abort(404)
+
 	name = g.db.query(BadgeDef.name).filter_by(id=bid).one()[0]
 
 	href = f'{SITE_FULL_IMAGES}/i/{SITE_NAME}/badges/{bid}.webp?b=11'