diff --git a/files/routes/awards.py b/files/routes/awards.py index 42de759dc..db4c1ff51 100644 --- a/files/routes/awards.py +++ b/files/routes/awards.py @@ -606,12 +606,10 @@ def admin_userawards_get(v): @app.post("/admin/awards") @limiter.limit("1/second") -@auth_required +@admin_level_required(2) @validate_formkey def admin_userawards_post(v): - if v.admin_level < 6: abort(403) - try: u = request.values.get("username").strip() except: abort(404) diff --git a/files/routes/reporting.py b/files/routes/reporting.py index 12fcc6ee7..d7c9be5af 100644 --- a/files/routes/reporting.py +++ b/files/routes/reporting.py @@ -69,13 +69,10 @@ def api_flag_comment(cid, v): @app.post('/del_report/') @limiter.limit("1/second") -@auth_required +@admin_level_required(2) @validate_formkey def remove_report(report_fn, v): - if v.admin_level < 6: - return {"error": "go outside"}, 403 - if report_fn.startswith('c'): report = g.db.query(CommentFlag).filter_by(id=int(report_fn.lstrip('c'))).first() elif report_fn.startswith('p'): diff --git a/files/routes/settings.py b/files/routes/settings.py index 6d8162018..fcced4a6c 100644 --- a/files/routes/settings.py +++ b/files/routes/settings.py @@ -793,7 +793,7 @@ def settings_css(v): @auth_required def settings_profilecss_get(v): - if v.truecoins < 1000 and not v.patron and v.admin_level < 6: return f"You must have +1000 {COINS_NAME} or be a patron to set profile css." + if v.truecoins < 1000 and not v.patron and v.admin_level == 0 : return f"You must have +1000 {COINS_NAME} or be a patron to set profile css." return render_template("settings_profilecss.html", v=v) @app.post("/settings/profilecss")