carpathianflorist
/
MarseyWorld
forked from MarseyWorld/MarseyWorld
1
0
Fork 0
Code Pull Requests Activity

remove exploit allowing jannies to unpin award pins

master
Aevann1 2022-10-23 23:52:04 +02:00
parent 1496f43ba6
commit 0b851d237c
2 changed files with 1 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
files/routes/admin.py
View File

@ -1121,8 +1121,6 @@ def remove_post(post_id, v):
post = get_post(post_id) post = get_post(post_id)
post.is_banned = True post.is_banned = True
post.is_approved = None post.is_approved = None
post.stickied = None
post.is_pinned = False
post.ban_reason = v.username post.ban_reason = v.username
g.db.add(post) g.db.add(post)

2
files/routes/users.py
View File

@ -804,7 +804,7 @@ def u_username(username, v=None):
if page == 1: if page == 1:
sticky = [] sticky = []
sticky = g.db.query(Submission).filter_by(is_pinned=True, author_id=u.id).all() sticky = g.db.query(Submission).filter_by(is_pinned=True, author_id=u.id, is_banned=False).all()
if sticky: if sticky:
for p in sticky: for p in sticky:
ids = [p.id] + ids ids = [p.id] + ids