heckyel/mediagoblin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Start to use the media_id in "admin" URLs.

Browse Source 
We have a bunch of URLs that are more for internal use. At
least they're definitely not intended to be posted
somewhere for long term useage.

When those things affect a media, it's much better to
reference the media by its id. This can't change, ever.
This is better for races.
Like someone posting a comment while the owner
corrects a typo in the slug.
This commit is contained in:
Elrond 2013-01-11 14:18:27 +01:00
parent 8b271c28bd
commit 461dd9717c
8 changed files with 27 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
mediagoblin/decorators.py
View File

@ -69,7 +69,7 @@ def user_may_delete_media(controller):
"""
@wraps(controller)
def wrapper(request, *args, **kwargs):
uploader_id = MediaEntry.query.get(request.matchdict['media']).uploader
uploader_id = kwargs['media'].uploader
if not (request.user.is_admin or
request.user.id == uploader_id):
raise Forbidden()
@ -209,12 +209,16 @@ def get_media_entry_by_id(controller):
@wraps(controller)
def wrapper(request, *args, **kwargs):
media = MediaEntry.query.filter_by(
id=request.matchdict['media'],
id=request.matchdict['media_id'],
state=u'processed').first()
# Still no media? Okay, 404.
if not media:
return render_404(request)
given_username = request.matchdict.get('user')
if given_username and (given_username != media.get_uploader.username):
return render_404(request)
return controller(request, media=media, *args, **kwargs)
return wrapper

3
mediagoblin/edit/views.py
View File

@ -27,6 +27,7 @@ from mediagoblin.auth import lib as auth_lib
from mediagoblin.edit import forms
from mediagoblin.edit.lib import may_edit_media
from mediagoblin.decorators import (require_active_login, active_user_from_url,
get_media_entry_by_id,
get_user_media_entry, user_may_alter_collection, get_user_collection)
from mediagoblin.tools.response import render_to_response, redirect
from mediagoblin.tools.translate import pass_to_ugettext as _
@ -37,7 +38,7 @@ from mediagoblin.db.util import check_media_slug_used, check_collection_slug_use
import mimetypes
@get_user_media_entry
@get_media_entry_by_id
@require_active_login
def edit_media(request, media):
if not may_edit_media(request, media):

2
mediagoblin/templates/mediagoblin/edit/edit.html
View File

@ -29,7 +29,7 @@
<form action="{{ request.urlgen('mediagoblin.edit.edit_media',
user= media.get_uploader.username,
media= media.id) }}"
media_id=media.id) }}"
method="POST" enctype="multipart/form-data">
<div class="form_box_xl edit_box">
<h1>{% trans media_title=media.title %}Editing {{ media_title }}{% endtrans %}</h1>

6
mediagoblin/templates/mediagoblin/user_pages/media.html
View File

@ -83,11 +83,11 @@
request.user.is_admin) %}
{% set edit_url = request.urlgen('mediagoblin.edit.edit_media',
user= media.get_uploader.username,
media= media.id) %}
media_id=media.id) %}
<a class="button_action" href="{{ edit_url }}">{% trans %}Edit{% endtrans %}</a>
{% set delete_url = request.urlgen('mediagoblin.user_pages.media_confirm_delete',
user= media.get_uploader.username,
media= media.id) %}
media_id=media.id) %}
<a class="button_action" href="{{ delete_url }}">{% trans %}Delete{% endtrans %}</a>
{% endif %}
{% autoescape False %}
@ -104,7 +104,7 @@
{% if request.user %}
<form action="{{ request.urlgen('mediagoblin.user_pages.media_post_comment',
user= media.get_uploader.username,
media=media.id) }}" method="POST" id="form_comment">
media_id=media.id) }}" method="POST" id="form_comment">
<p>
{% trans %}You can use <a href="http://daringfireball.net/projects/markdown/basics">Markdown</a> for formatting.{% endtrans %}
</p>

2
mediagoblin/templates/mediagoblin/user_pages/media_confirm_delete.html
View File

@ -23,7 +23,7 @@
<form action="{{ request.urlgen('mediagoblin.user_pages.media_confirm_delete',
user=media.get_uploader.username,
media=media.id) }}"
media_id=media.id) }}"
method="POST" enctype="multipart/form-data">
<div class="form_box">
<h1>

10
mediagoblin/tests/test_submission.py
View File

@ -161,11 +161,17 @@ class TestSubmission:
media = self.check_media(request, {'title': u'Balanced Goblin'}, 1)
media_id = media.id
# At least render the edit page
edit_url = request.urlgen(
'mediagoblin.edit.edit_media',
user=self.test_user.username, media_id=media_id)
self.test_app.get(edit_url)
# Add a comment, so we can test for its deletion later.
self.check_comments(request, media_id, 0)
comment_url = request.urlgen(
'mediagoblin.user_pages.media_post_comment',
user=self.test_user.username, media=media_id)
user=self.test_user.username, media_id=media_id)
response = self.do_post({'comment_content': 'i love this test'},
url=comment_url, do_follow=True)[0]
self.check_comments(request, media_id, 1)
@ -174,7 +180,7 @@ class TestSubmission:
# ---------------------------------------------------
delete_url = request.urlgen(
'mediagoblin.user_pages.media_confirm_delete',
user=self.test_user.username, media=media_id)
user=self.test_user.username, media_id=media_id)
# Empty data means don't confirm
response = self.do_post({}, do_follow=True, url=delete_url)[0]
media = self.check_media(request, {'title': u'Balanced Goblin'}, 1)

6
mediagoblin/user_pages/routing.py
View File

@ -24,12 +24,12 @@ add_route('mediagoblin.user_pages.media_home',
'mediagoblin.user_pages.views:media_home')
add_route('mediagoblin.user_pages.media_confirm_delete',
'/u/<string:user>/m/<string:media>/confirm-delete/',
'/u/<string:user>/m/<int:media_id>/confirm-delete/',
'mediagoblin.user_pages.views:media_confirm_delete')
# Submission handling of new comments. TODO: only allow for POST methods
add_route('mediagoblin.user_pages.media_post_comment',
'/u/<string:user>/m/<string:media>/comment/add/',
'/u/<string:user>/m/<int:media_id>/comment/add/',
'mediagoblin.user_pages.views:media_post_comment')
add_route('mediagoblin.user_pages.user_gallery',
@ -74,7 +74,7 @@ add_route('mediagoblin.user_pages.processing_panel',
# Stray edit routes
add_route('mediagoblin.edit.edit_media',
'/u/<string:user>/m/<string:media>/edit/',
'/u/<string:user>/m/<int:media_id>/edit/',
'mediagoblin.edit.views:edit_media')
add_route('mediagoblin.edit.attachments',

5
mediagoblin/user_pages/views.py
View File

@ -28,6 +28,7 @@ from mediagoblin.user_pages import forms as user_forms
from mediagoblin.user_pages.lib import send_comment_email
from mediagoblin.decorators import (uses_pagination, get_user_media_entry,
get_media_entry_by_id,
require_active_login, user_may_delete_media, user_may_alter_collection,
get_user_collection, get_user_collection_item, active_user_from_url)
@ -138,7 +139,7 @@ def media_home(request, media, page, **kwargs):
'app_config': mg_globals.app_config})
@get_user_media_entry
@get_media_entry_by_id
@require_active_login
def media_post_comment(request, media):
"""
@ -258,7 +259,7 @@ def media_collect(request, media):
#TODO: Why does @user_may_delete_media not implicate @require_active_login?
@get_user_media_entry
@get_media_entry_by_id
@require_active_login
@user_may_delete_media
def media_confirm_delete(request, media):