Do not pass over perms variable manually to the post template. Fixed thread

diff using old method to check permissions

boards/models/post/__init__.py

@@ -1,361 +1,360 b''
 import logging
 import re
 import uuid
 
 from django.core.exceptions import ObjectDoesNotExist
 from django.core.urlresolvers import reverse
 from django.db import models
 from django.db.models import TextField, QuerySet
 from django.template.defaultfilters import striptags, truncatewords
 from django.template.loader import render_to_string
 from django.utils import timezone
 
 from boards import settings
 from boards.abstracts.tripcode import Tripcode
 from boards.mdx_neboard import Parser
 from boards.models import PostImage, Attachment
 from boards.models.base import Viewable
 from boards.models.post.export import get_exporter, DIFF_TYPE_JSON
 from boards.models.post.manager import PostManager
 from boards.models.user import Notification
 
 CSS_CLS_HIDDEN_POST = 'hidden_post'
 CSS_CLS_DEAD_POST = 'dead_post'
 CSS_CLS_ARCHIVE_POST = 'archive_post'
 CSS_CLS_POST = 'post'
 
 TITLE_MAX_WORDS = 10
 
 APP_LABEL_BOARDS = 'boards'
 
 BAN_REASON_AUTO = 'Auto'
 
 IMAGE_THUMB_SIZE = (200, 150)
 
 TITLE_MAX_LENGTH = 200
 
 REGEX_REPLY = re.compile(r'\[post\](\d+)\[/post\]')
 REGEX_NOTIFICATION = re.compile(r'\[user\](\w+)\[/user\]')
 
 PARAMETER_TRUNCATED = 'truncated'
 PARAMETER_TAG = 'tag'
 PARAMETER_OFFSET = 'offset'
 PARAMETER_DIFF_TYPE = 'type'
 PARAMETER_CSS_CLASS = 'css_class'
 PARAMETER_THREAD = 'thread'
 PARAMETER_IS_OPENING = 'is_opening'
-PARAMETER_MODERATOR = 'moderator'
 PARAMETER_POST = 'post'
 PARAMETER_OP_ID = 'opening_post_id'
 PARAMETER_NEED_OPEN_LINK = 'need_open_link'
 PARAMETER_REPLY_LINK = 'reply_link'
 PARAMETER_NEED_OP_DATA = 'need_op_data'
 
 POST_VIEW_PARAMS = (
     'need_op_data',
     'reply_link',
     'need_open_link',
     'truncated',
     'mode_tree',
     'perms',
 )
 
 
 class Post(models.Model, Viewable):
     """A post is a message."""
 
     objects = PostManager()
 
     class Meta:
         app_label = APP_LABEL_BOARDS
         ordering = ('id',)
 
     title = models.CharField(max_length=TITLE_MAX_LENGTH, null=True, blank=True)
     pub_time = models.DateTimeField()
     text = TextField(blank=True, null=True)
     _text_rendered = TextField(blank=True, null=True, editable=False)
 
     images = models.ManyToManyField(PostImage, null=True, blank=True,
                                     related_name='post_images', db_index=True)
     attachments = models.ManyToManyField(Attachment, null=True, blank=True,
                                          related_name='attachment_posts')
 
     poster_ip = models.GenericIPAddressField()
 
     # TODO This field can be removed cause UID is used for update now
     last_edit_time = models.DateTimeField()
 
     referenced_posts = models.ManyToManyField('Post', symmetrical=False,
                                               null=True,
                                               blank=True, related_name='refposts',
                                               db_index=True)
     refmap = models.TextField(null=True, blank=True)
     threads = models.ManyToManyField('Thread', db_index=True,
                                      related_name='multi_replies')
     thread = models.ForeignKey('Thread', db_index=True, related_name='pt+')
 
     url = models.TextField()
     uid = models.TextField(db_index=True)
 
     tripcode = models.CharField(max_length=50, blank=True, default='')
     opening = models.BooleanField(db_index=True)
     hidden = models.BooleanField(default=False)
 
     def __str__(self):
         return 'P#{}/{}'.format(self.id, self.get_title())
 
     def get_referenced_posts(self):
         threads = self.get_threads().all()
         return self.referenced_posts.filter(threads__in=threads)\
             .order_by('pub_time').distinct().all()
 
     def get_title(self) -> str:
         return self.title
 
     def get_title_or_text(self):
         title = self.get_title()
         if not title:
             title = truncatewords(striptags(self.get_text()), TITLE_MAX_WORDS)
 
         return title
 
     def build_refmap(self) -> None:
         """
         Builds a replies map string from replies list. This is a cache to stop
         the server from recalculating the map on every post show.
         """
 
         post_urls = [refpost.get_link_view()
                      for refpost in self.referenced_posts.all()]
 
         self.refmap = ', '.join(post_urls)
 
     def is_referenced(self) -> bool:
         return self.refmap and len(self.refmap) > 0
 
     def is_opening(self) -> bool:
         """
         Checks if this is an opening post or just a reply.
         """
 
         return self.opening
 
     def get_absolute_url(self, thread=None):
         url = None
 
         if thread is None:
             thread = self.get_thread()
 
             # Url is cached only for the "main" thread. When getting url
             # for other threads, do it manually.
             if self.url:
                 url = self.url
 
         if url is None:
             opening_id = thread.get_opening_post_id()
             url = reverse('thread', kwargs={'post_id': opening_id})
             if self.id != opening_id:
                 url += '#' + str(self.id)
 
         return url
 
     def get_thread(self):
         return self.thread
 
     def get_threads(self) -> QuerySet:
         """
         Gets post's thread.
         """
 
         return self.threads
 
     def get_view(self, *args, **kwargs) -> str:
         """
         Renders post's HTML view. Some of the post params can be passed over
         kwargs for the means of caching (if we view the thread, some params
         are same for every post and don't need to be computed over and over.
         """
 
         thread = self.get_thread()
 
         css_classes = [CSS_CLS_POST]
         if thread.archived:
             css_classes.append(CSS_CLS_ARCHIVE_POST)
         elif not thread.can_bump():
             css_classes.append(CSS_CLS_DEAD_POST)
         if self.is_hidden():
             css_classes.append(CSS_CLS_HIDDEN_POST)
 
         params = dict()
         for param in POST_VIEW_PARAMS:
             if param in kwargs:
                 params[param] = kwargs[param]
 
         params.update({
             PARAMETER_POST: self,
             PARAMETER_IS_OPENING: self.is_opening(),
             PARAMETER_THREAD: thread,
             PARAMETER_CSS_CLASS: ' '.join(css_classes),
         })
 
         return render_to_string('boards/post.html', params)
 
     def get_search_view(self, *args, **kwargs):
         return self.get_view(need_op_data=True, *args, **kwargs)
 
     def get_first_image(self) -> PostImage:
         return self.images.earliest('id')
 
     def delete(self, using=None):
         """
         Deletes all post images and the post itself.
         """
 
         for image in self.images.all():
             image_refs_count = image.post_images.count()
             if image_refs_count == 1:
                 image.delete()
 
         for attachment in self.attachments.all():
             attachment_refs_count = attachment.attachment_posts.count()
             if attachment_refs_count == 1:
                 attachment.delete()
 
         thread = self.get_thread()
         thread.last_edit_time = timezone.now()
         thread.save()
 
         super(Post, self).delete(using)
 
         logging.getLogger('boards.post.delete').info(
             'Deleted post {}'.format(self))
 
     def get_post_data(self, format_type=DIFF_TYPE_JSON, request=None,
                       include_last_update=False) -> str:
         """
         Gets post HTML or JSON data that can be rendered on a page or used by
         API.
         """
 
         return get_exporter(format_type).export(self, request,
                                                 include_last_update)
 
     def notify_clients(self, recursive=True):
         """
         Sends post HTML data to the thread web socket.
         """
 
         if not settings.get_bool('External', 'WebsocketsEnabled'):
             return
 
         thread_ids = list()
         for thread in self.get_threads().all():
             thread_ids.append(thread.id)
 
             thread.notify_clients()
 
         if recursive:
             for reply_number in re.finditer(REGEX_REPLY, self.get_raw_text()):
                 post_id = reply_number.group(1)
 
                 try:
                     ref_post = Post.objects.get(id=post_id)
 
                     if ref_post.get_threads().exclude(id__in=thread_ids).exists():
                         # If post is in this thread, its thread was already notified.
                         # Otherwise, notify its thread separately.
                         ref_post.notify_clients(recursive=False)
                 except ObjectDoesNotExist:
                     pass
 
     def build_url(self):
         self.url = self.get_absolute_url()
         self.save(update_fields=['url'])
 
     def save(self, force_insert=False, force_update=False, using=None,
              update_fields=None):
         self._text_rendered = Parser().parse(self.get_raw_text())
 
         self.uid = str(uuid.uuid4())
         if update_fields is not None and 'uid' not in update_fields:
             update_fields += ['uid']
 
         if self.id:
             for thread in self.get_threads().all():
                 thread.last_edit_time = self.last_edit_time
 
                 thread.save(update_fields=['last_edit_time', 'bumpable'])
 
         super().save(force_insert, force_update, using, update_fields)
 
     def get_text(self) -> str:
         return self._text_rendered
 
     def get_raw_text(self) -> str:
         return self.text
 
     def get_absolute_id(self) -> str:
         """
         If the post has many threads, shows its main thread OP id in the post
         ID.
         """
 
         if self.get_threads().count() > 1:
             return '{}/{}'.format(self.get_thread().get_opening_post_id(), self.id)
         else:
             return str(self.id)
 
     def connect_notifications(self):
         for reply_number in re.finditer(REGEX_NOTIFICATION, self.get_raw_text()):
             user_name = reply_number.group(1).lower()
             Notification.objects.get_or_create(name=user_name, post=self)
 
     def connect_replies(self):
         """
         Connects replies to a post to show them as a reflink map
         """
 
         for reply_number in re.finditer(REGEX_REPLY, self.get_raw_text()):
             post_id = reply_number.group(1)
 
             try:
                 referenced_post = Post.objects.get(id=post_id)
 
                 referenced_post.referenced_posts.add(self)
                 referenced_post.last_edit_time = self.pub_time
                 referenced_post.build_refmap()
                 referenced_post.save(update_fields=['refmap', 'last_edit_time'])
             except ObjectDoesNotExist:
                 pass
 
     def connect_threads(self, opening_posts):
         for opening_post in opening_posts:
             threads = opening_post.get_threads().all()
             for thread in threads:
                 if thread.can_bump():
                     thread.update_bump_status()
 
                 thread.last_edit_time = self.last_edit_time
                 thread.save(update_fields=['last_edit_time', 'bumpable'])
             self.threads.add(opening_post.get_thread())
 
     def get_tripcode(self):
         if self.tripcode:
             return Tripcode(self.tripcode)
 
     def get_link_view(self):
         """
         Gets view of a reflink to the post.
         """
         result = '<a href="{}">&gt;&gt;{}</a>'.format(self.get_absolute_url(),
                                                       self.id)
         if self.is_opening():
             result = '<b>{}</b>'.format(result)
 
         return result
 
     def is_hidden(self) -> bool:
         return self.hidden
 
     def set_hidden(self, hidden):
         self.hidden = hidden

boards/models/post/export.py

@@ -1,55 +1,57 b''
+from django.contrib.auth.context_processors import PermWrapper
+
 from boards import utils
 
 
 PARAMETER_TRUNCATED = 'truncated'
 
 DIFF_TYPE_HTML = 'html'
 DIFF_TYPE_JSON = 'json'
 
 
 class Exporter():
     @staticmethod
     def export(post, request, include_last_update) -> str:
         pass
 
 
 class HtmlExporter(Exporter):
     @staticmethod
     def export(post, request, include_last_update):
         if request is not None and PARAMETER_TRUNCATED in request.GET:
             truncated = True
             reply_link = False
         else:
             truncated = False
             reply_link = True
 
         return post.get_view(truncated=truncated, reply_link=reply_link,
-                             moderator=utils.is_moderator(request))
+                perms=PermWrapper(request.user))
 
 
 class JsonExporter(Exporter):
     @staticmethod
     def export(post, request, include_last_update):
         post_json = {
             'id': post.id,
             'title': post.title,
             'text': post.get_raw_text(),
             }
         if post.images.exists():
             post_image = post.get_first_image()
             post_json['image'] = post_image.image.url
             post_json['image_preview'] = post_image.image.url_200x150
         if include_last_update:
             post_json['bump_time'] = utils.datetime_to_epoch(
                 post.get_thread().bump_time)
         return post_json
 
 
 EXPORTERS = {
     DIFF_TYPE_HTML: HtmlExporter,
     DIFF_TYPE_JSON: JsonExporter,
 }
 
 
 def get_exporter(export_type: str) -> Exporter:
     return EXPORTERS[export_type]()

boards/templates/boards/all_threads.html

@@ -1,186 +1,186 b''
 {% extends "boards/base.html" %}
 
 {% load i18n %}
 {% load board %}
 {% load static %}
 {% load tz %}
 
 {% block head %}
     <meta name="robots" content="noindex">
 
     {% if tag %}
         <title>{{ tag.name }} - {{ site_name }}</title>
     {% else %}
         <title>{{ site_name }}</title>
     {% endif %}
 
     {% if prev_page_link %}
         <link rel="prev" href="{{ prev_page_link }}" />
     {% endif %}
     {% if next_page_link %}
         <link rel="next" href="{{ next_page_link }}" />
     {% endif %}
 
 {% endblock %}
 
 {% block content %}
 
     {% get_current_language as LANGUAGE_CODE %}
     {% get_current_timezone as TIME_ZONE %}
 
     {% for banner in banners %}
         <div class="post">
             <div class="title">{{ banner.title }}</div>
             <div>{{ banner.text }}</div>
             <div>{% trans 'Related message' %}: <a href="{{ banner.post.get_absolute_url }}">>>{{ banner.post.id }}</a></div>
         </div>
     {% endfor %}
 
 {% if tag %}
     <div class="tag_info" style="border-bottom: solid .5ex #{{ tag.get_color }}">
         {% if random_image_post %}
             <div class="tag-image">
                 {% with image=random_image_post.images.first %}
                     <a href="{{ random_image_post.get_absolute_url }}"><img 
                         src="{{ image.image.url_200x150 }}"
                         width="{{ image.pre_width }}"
                         height="{{ image.pre_height }}"/></a>
                 {% endwith %}
             </div>
         {% endif %}
         <div class="tag-text-data">
             <h2>
                 <form action="{% url 'tag' tag.name %}" method="post" class="post-button-form">
                     {% if is_favorite %}
                         <button name="method" value="unsubscribe" class="fav">★</button>
                     {% else %}
                         <button name="method" value="subscribe" class="not_fav">★</button>
                     {% endif %}
                 </form>
                 <form action="{% url 'tag' tag.name %}" method="post" class="post-button-form">
                     {% if is_hidden %}
                         <button name="method" value="unhide" class="fav">H</button>
                     {% else %}
                         <button name="method" value="hide" class="not_fav">H</button>
                     {% endif %}
                 </form>
                 {{ tag.get_view|safe }}
                 {% if moderator %}
                 <span class="moderator_info">| <a href="{% url 'admin:boards_tag_change' tag.id %}">{% trans 'Edit tag' %}</a></span>
                 {% endif %}
             </h2>
             {% if tag.get_description %}
                 <p>{{ tag.get_description|safe }}</p>
             {% endif %}
             <p>
                 {% blocktrans count count=tag.get_active_thread_count %}{{ count }} active thread{% plural %}active threads{% endblocktrans %},
                 {% blocktrans count count=tag.get_bumplimit_thread_count %}{{ count }} thread in bumplimit{% plural %} threads in bumplimit{% endblocktrans %},
                 {% blocktrans count count=tag.get_archived_thread_count %}{{ count }} archived thread{% plural %}archived threads{% endblocktrans %},
                 {% blocktrans count count=tag.get_post_count %}{{ count }} message{% plural %}messages{% endblocktrans %}.
             </p>
             {% if tag.get_all_parents %}
                 <p>
                     {% for parent in tag.get_all_parents %}
                         {{ parent.get_view|safe }} &gt;
                     {% endfor %}
                     {{ tag.get_view|safe }}
                 </p>
             {% endif %}
         </div>
     </div>
 {% endif %}
 
     {% if threads %}
         {% if prev_page_link %}
             <div class="page_link">
                 <a href="{{ prev_page_link }}">{% trans "Previous page" %}</a>
             </div>
         {% endif %}
 
         {% for thread in threads %}
             <div class="thread">
-                {% post_view thread.get_opening_post perms=perms thread=thread truncated=True need_open_link=True %}
+                {% post_view thread.get_opening_post thread=thread truncated=True need_open_link=True %}
                 {% if not thread.archived %}
                     {% with last_replies=thread.get_last_replies %}
                         {% if last_replies %}
                             {% with skipped_replies_count=thread.get_skipped_replies_count %}
                                 {% if skipped_replies_count %}
                                     <div class="skipped_replies">
                                         <a href="{% url 'thread' thread.get_opening_post_id %}">
                                             {% blocktrans count count=skipped_replies_count %}Skipped {{ count }} reply. Open thread to see all replies.{% plural %}Skipped {{ count }} replies. Open thread to see all replies.{% endblocktrans %}
                                         </a>
                                     </div>
                                 {% endif %}
                             {% endwith %}
                             <div class="last-replies">
                                 {% for post in last_replies %}
-                                    {% post_view post perms=perms truncated=True %}
+                                    {% post_view post truncated=True %}
                                 {% endfor %}
                             </div>
                         {% endif %}
                     {% endwith %}
                 {% endif %}
             </div>
         {% endfor %}
 
         {% if next_page_link %}
             <div class="page_link">
                 <a href="{{ next_page_link }}">{% trans "Next page" %}</a>
             </div>
         {% endif %}
     {% else %}
         <div class="post">
             {% trans 'No threads exist. Create the first one!' %}</div>
     {% endif %}
 
     <div class="post-form-w">
         <script src="{% static 'js/panel.js' %}"></script>
         <div class="post-form">
             <div class="form-title">{% trans "Create new thread" %}</div>
             <div class="swappable-form-full">
             <form enctype="multipart/form-data" method="post" id="form">{% csrf_token %}
                 {{ form.as_div }}
                 <div class="form-submit">
                     <input type="submit" value="{% trans "Post" %}"/>
                     <button id="preview-button" onclick="return false;">{% trans 'Preview' %}</button>
                 </div>
             </form>
             </div>
             <div>
                 {% trans 'Tags must be delimited by spaces. Text or image is required.' %}
             </div>
             <div id="preview-text"></div>
             <div><a href="{% url "staticpage" name="help" %}">{% trans 'Text syntax' %}</a></div>
             <div><a href="{% url "tags" "required" %}">{% trans 'Tags' %}</a></div>
         </div>
     </div>
 
     <script src="{% static 'js/form.js' %}"></script>
     <script src="{% static 'js/thread_create.js' %}"></script>
 
 {% endblock %}
 
 {% block metapanel %}
 
     <span class="metapanel">
         <b><a href="{% url "authors" %}">{{ site_name }}</a> {{ version }}</b>
         {% trans "Pages:" %}
         [
         {% with dividers=paginator.get_dividers %}
             {% for page in paginator.get_divided_range %}
                 {% if page in dividers %}
                     …,
                 {% endif %}
                 <a
                     {% ifequal page current_page.number %}
                         class="current_page"
                     {% endifequal %}
                     href="{% page_url paginator page %}">{{ page }}</a>
                 {% if not forloop.last %},{% endif %}
             {% endfor %}
         {% endwith %}
         ]
         [<a href="rss/">RSS</a>]
     </span>
 
 {% endblock %}

boards/templates/boards/thread_normal.html

@@ -1,70 +1,70 b''
 {% extends "boards/thread.html" %}
 
 {% load i18n %}
 {% load static from staticfiles %}
 {% load board %}
 {% load tz %}
 
 {% block thread_content %}
     {% get_current_language as LANGUAGE_CODE %}
     {% get_current_timezone as TIME_ZONE %}
 
     <div class="tag_info">
         <h2>
             <form action="{% url 'thread' opening_post.id %}" method="post" class="post-button-form">
                 {% if is_favorite %}
                     <button name="method" value="unsubscribe" class="fav">★</button>
                 {% else %}
                     <button name="method" value="subscribe" class="not_fav">★</button>
                 {% endif %}
             </form>
             {{ opening_post.get_title_or_text }}
         </h2>
     </div>
 
     {% if bumpable and thread.has_post_limit %}
         <div class="bar-bg">
             <div class="bar-value" style="width:{{ bumplimit_progress }}%" id="bumplimit_progress">
             </div>
             <div class="bar-text">
                 <span id="left_to_limit">{{ posts_left }}</span> {% trans 'posts to bumplimit' %}
             </div>
         </div>
     {% endif %}
 
     <div class="thread">
         {% for post in thread.get_replies %}
-            {% post_view post perms=perms reply_link=True %}
+            {% post_view post reply_link=True %}
         {% endfor %}
     </div>
 
     {% if not thread.archived %}
         <div class="post-form-w">
             <script src="{% static 'js/panel.js' %}"></script>
             <div class="form-title">{% trans "Reply to thread" %} #{{ opening_post.id }}<span class="reply-to-message"> {% trans "to message " %} #<span id="reply-to-message-id"></span></span></div>
             <div class="post-form" id="compact-form">
                 <div class="swappable-form-full">
                     <form enctype="multipart/form-data" method="post" id="form">{% csrf_token %}
                         <div class="compact-form-text"></div>
                         {{ form.as_div }}
                         <div class="form-submit">
                             <input type="submit" value="{% trans "Post" %}"/>
                             <button id="preview-button" onclick="return false;">{% trans 'Preview' %}</button>
                         </div>
                     </form>
                 </div>
                 <div id="preview-text"></div>
                 <div><a href="{% url "staticpage" name="help" %}">
                     {% trans 'Text syntax' %}</a></div>
                 <div><a id="form-close-button" href="#" onClick="resetFormPosition(); return false;">{% trans 'Close form' %}</a></div>
             </div>
         </div>
 
         <script src="{% static 'js/jquery.form.min.js' %}"></script>
     {% endif %}
 
     <script src="{% static 'js/form.js' %}"></script>
     <script src="{% static 'js/thread.js' %}"></script>
     <script src="{% static 'js/thread_update.js' %}"></script>
     <script src="{% static 'js/3party/centrifuge.js' %}"></script>
 {% endblock %}

boards/templatetags/board.py

@@ -1,49 +1,50 b''
 import re
 from django.shortcuts import get_object_or_404
 from django import template
 
 
 IMG_ACTION_URL = '[<a href="{}">{}</a>]'
 
 
 register = template.Library()
 
 actions = [
     {
         'name': 'google',
         'link': 'http://google.com/searchbyimage?image_url=%s',
     },
     {
         'name': 'iqdb',
         'link': 'http://iqdb.org/?url=%s',
     },
 ]
 
 
 @register.simple_tag(name='post_url')
 def post_url(*args, **kwargs):
     post_id = args[0]
 
     post = get_object_or_404('Post', id=post_id)
 
     return post.get_absolute_url()
 
 
 @register.simple_tag(name='image_actions')
 def image_actions(*args, **kwargs):
     image_link = args[0]
     if len(args) > 1:
         image_link = 'http://' + args[1] + image_link  # TODO https?
 
     return ', '.join([IMG_ACTION_URL.format(
         action['link'] % image_link, action['name']) for action in actions])
 
 
[e-mail]_tag(name='post_view')
-def post_view(post, *args, **kwargs):
[e-mail]_tag(name='post_view', takes_context=True)
+def post_view(context, post, *args, **kwargs):
+    kwargs['perms'] = context['perms']
     return post.get_view(*args, **kwargs)
 
 @register.simple_tag(name='page_url')
 def page_url(paginator, page_number, *args, **kwargs):
     if paginator.supports_urls():
         return paginator.get_page_url(page_number)