rDrama
/
rDrama
9
10
Fork 7
Code Issues Pull Requests Packages Releases Wiki Activity

make can_see give 403 error instead of 404

pull/98/head
Aevann 2023-01-25 12:59:45 +02:00
parent 1496b12e8f
commit c4d3234988
3 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
files/routes/comments.py
View File

@ -33,7 +33,7 @@ WORDLE_COLOR_MAPPINGS = {-1: "🟥", 0: "🟨", 1: "🟩"}
def post_pid_comment_cid(cid, pid=None, anything=None, v=None, sub=None):
comment = get_comment(cid, v=v)
if not User.can_see(v, comment): abort(404)
if not User.can_see(v, comment): abort(403)
if v and request.values.get("read"):
notif = g.db.query(Notification).filter_by(comment_id=cid, user_id=v.id, read=False).one_or_none()
@ -121,7 +121,7 @@ def comment(v:User):
parent_user = parent if isinstance(parent, User) else parent.author
posting_to_submission = isinstance(post_target, Submission)
if not User.can_see(v, parent): abort(404)
if not User.can_see(v, parent): abort(403)
if not isinstance(parent, User) and parent.deleted_utc != 0:
if isinstance(parent, Submission):
abort(403, "This post has been deleted!")

2
files/routes/users.py
View File

@ -834,7 +834,7 @@ def u_username_wall(v:Optional[User], username:str):
def u_username_wall_comment(v:User, username:str, cid):
comment = get_comment(cid, v=v)
if not comment.wall_user_id: abort(400)
if not User.can_see(v, comment): abort(404)
if not User.can_see(v, comment): abort(403)
u = comment.wall_user

2
files/routes/votes.py
View File

@ -68,7 +68,7 @@ def vote_post_comment(target_id, new, v, cls, vote_cls):
else:
abort(404)
if not User.can_see(v, target): abort(404)
if not User.can_see(v, target): abort(403)
coin_delta = 1
if v.id == target.author.id: