X-Git-Url: http://git.cyclocoop.org/?a=blobdiff_plain;f=main.py;h=e2e7d81ed7dc398e24518b95c902888c2df734ed;hb=9a0891ac3f5ae69cd1e276931401516b3213df4c;hp=735fa6d5a1a1a77238622a92e176bfc822aef119;hpb=965e005bba1208ef170275c170bd7f7cc1cadbfa;p=cavote.git diff --git a/main.py b/main.py index 735fa6d..e2e7d81 100755 --- a/main.py +++ b/main.py @@ -61,6 +61,15 @@ def disconnect_user(): def crypt(passwd): return hashlib.sha1(passwd).hexdigest() +def get_userid(): + user = session.get('user') + if user is None: + return -1 + elif not user.get('id') > 0: + return -1 + else: + return user.get('id') + @app.route('/login', methods=['GET', 'POST']) def login(): if request.method == 'POST': @@ -110,14 +119,14 @@ def login_key(userid, key): @app.route('/user/') def user(userid): - if int(userid) != session.get('user').get('id'): + if int(userid) != get_userid(): abort(401) groups = query_db('select * from roles join user_role on id=id_role where id_user = ?', userid) return render_template('user.html', groups=groups) @app.route('/user/settings/', methods=['GET', 'POST']) def user_edit(userid): - if int(userid) != session.get('user').get('id'): + if int(userid) != get_userid(): abort(401) if request.method == 'POST': if query_db('select * from users where email=? and id!=?', [request.form['email'], userid], one=True) is None: @@ -125,7 +134,7 @@ def user_edit(userid): g.db.execute('update users set email = ?, name = ?, organization = ? where id = ?', [request.form['email'], request.form['name'], request.form['organization'], session['user']['id']]) g.db.commit() - disconnect_user() # :TODO:maethor:120528: Maybe useless, but this is simple way to refresh session :D + disconnect_user() user = query_db('select * from users where id=?', [userid], one=True) if user is None: flash(u'Une erreur s\'est produite.', 'error') @@ -140,7 +149,7 @@ def user_edit(userid): @app.route('/user/password/', methods=['GET', 'POST']) def user_password(userid): - if int(userid) != session.get('user').get('id'): + if int(userid) != get_userid(): abort(401) if request.method == 'POST': if request.form['password'] == request.form['password2']: @@ -171,7 +180,7 @@ def admin_users(): users[t['userid']]['is_admin'] = t['is_admin'] users[t['userid']]['roles'] = [t['rolename']] - return render_template('admin_users.html', users=users) + return render_template('admin_users.html', users=users.values()) @app.route('/admin/users/add', methods=['GET', 'POST']) def admin_user_add(): @@ -262,29 +271,69 @@ def votes(votes): # Vote def can_see_vote(idvote, iduser=-1): - user = query_db('select * from users where id=?', [iduser], one=True) vote = query_db('select * from votes where id=?', [idvote], one=True) - if user is None and not vote.is_public: - return False - return True # :TODO:maethor:20120529: Check others things + if vote is None: + abort(404) + if not vote['is_public']: + user = query_db('select * from users where id=?', [iduser], one=True) + if user is None: # :TODO:maethor:120604: Check others things (groups) + return False + return True def can_vote(idvote, iduser=-1): - if not can_see_vote(idvote, iduser): - return False - return True # :TODO:maethor:20120529: Check others things + if iduser > 0: + if can_see_vote(idvote, iduser): + if not has_voted(idvote, iduser): + return True # :TODO:maethor:120529: Check others things (groups) + return False + +def has_voted(idvote, iduser=-1): + vote = query_db('select * from user_choice join choices on id_choice=choices.id where id_vote = ? and id_user = ?', [idvote, iduser], one=True) + return (vote is not None) -@app.route('/vote/') +@app.route('/vote/', methods=['GET', 'POST']) def vote(idvote): vote = query_db('select *, roles.name as rolename from votes join roles on roles.id=votes.id_role where votes.id=?', [idvote], one=True) if vote is None: abort(404) - if can_see_vote(idvote, session.get('user').get('id')): - choices = query_db('select * from choices where id_vote=?', [idvote]) + if can_see_vote(idvote, get_userid()): + if request.method == 'POST': + if can_vote(idvote, get_userid()): + choices = query_db('select name, id from choices where id_vote=?', [idvote]) + for choice in choices: + if str(choice['id']) in request.form.keys(): + g.db.execute('insert into user_choice (id_user, id_choice) values (?, ?)', + [session.get('user').get('id'), choice['id']]) + g.db.commit() + if vote['is_multiplechoice'] == 0: + break + else: + abort(401) + tuples = query_db('select choiceid, choicename, users.id as userid, users.name as username from (select choices.id as choiceid, choices.name as choicename, id_user as userid from choices join user_choice on choices.id = user_choice.id_choice where id_vote = ?) join users on userid = users.id', [idvote]) + users = dict() + for t in tuples: + if t['userid'] in users: + users[t['userid']]['choices'].append(t['choiceid']) + else: + users[t['userid']] = dict() + users[t['userid']]['userid'] = t['userid'] + users[t['userid']]['username'] = t['username'] + users[t['userid']]['choices'] = [t['choiceid']] + choices = query_db('select choices.name, choices.id, choices.name, choices.id_vote, count(id_choice) as nb from choices left join user_choice on id_choice = choices.id where id_vote = ? group by id_choice, name, id_vote', [idvote]) attachments = query_db('select * from attachments where id_vote=?', [idvote]) - return render_template('vote.html', vote=vote, attachments=attachments, choices=choices, can_vote=can_vote(idvote, session.get('user').get('id'))) + return render_template('vote.html', vote=vote, attachments=attachments, choices=choices, users=users.values(), can_vote=can_vote(idvote, get_userid())) flash('Vous n\'avez pas le droit de voir ce vote, désolé.') return(url_for('home')) +@app.route('/vote/deletechoices//') +def vote_deletechoices(idvote): + if (not has_voted(idvote, get_userid())) or iduser != get_userid(): + abort(401) + g.db.execute('delete from user_choice where id_user = ? and id_choice in (select id from choices where id_vote = ?)', + [iduser, idvote]) + g.db.commit() + return redirect(url_for('vote', idvote=idvote)) + #------------- # Votes admin @@ -319,7 +368,7 @@ def admin_vote_add(): [request.form['title'], request.form['description'], request.form['category'], date_begin, date_end, transparent, public, multiplechoice, role['id'], session['user']['id']]) g.db.commit() vote = query_db('select * from votes where title = ? and date_begin = ? order by id desc', - [request.form['title'], date_begin], one=True) # :DEBUG:maethor:20120528: Bug possible car le titre n'est pas unique + [request.form['title'], date_begin], one=True) # :DEBUG:maethor:120528: Bug possible car le titre n'est pas unique if vote is None: flash(u'Une erreur est survenue !', 'error') return redirect(url_for('home')) @@ -348,7 +397,7 @@ def admin_vote_edit(voteid): if 'public' in request.form.keys(): public = 1 isopen = 0 - if request.form['status'] == 'Ouvert': # :TODO:maethor:20120529: Check if there is at least 2 choices before + if request.form['status'] == 'Ouvert': # :TODO:maethor:120529: Check if there is at least 2 choices before isopen = 1 g.db.execute('update votes set title = ?, description = ?, category = ?, is_transparent = ?, is_public = ?, is_open = ? where id = ?', [request.form['title'], request.form['description'], request.form['category'], transparent, public, isopen, voteid]) @@ -358,11 +407,12 @@ def admin_vote_edit(voteid): else: flash(u'Vous devez spécifier un titre.', 'error') - # :TODO:maethor:20120529: Calculer la durée du vote (différence date_end - date_begin) + # :TODO:maethor:120529: Calculer la durée du vote (différence date_end - date_begin) vote['duration'] = 15 group = query_db('select name from roles where id = ?', [vote['id_role']], one=True) choices = query_db('select * from choices where id_vote = ?', [voteid]) - return render_template('admin_vote_edit.html', vote=vote, group=group, choices=choices) + attachments = query_db('select * from attachments where id_vote = ?', [voteid]) + return render_template('admin_vote_edit.html', vote=vote, group=group, choices=choices, attachments=attachments) @app.route('/admin/votes/addchoice/', methods=['POST']) def admin_vote_addchoice(voteid): @@ -385,7 +435,7 @@ def admin_vote_editchoice(voteid, choiceid): if request.method == 'POST': g.db.execute('update choices set name=? where id = ? and id_vote = ?', [request.form['title'], choiceid, voteid]) g.db.commit() - elif request.method == 'DELETE': # :COMMENT:maethor:20120528: I can't find how to use it from template + elif request.method == 'DELETE': # :COMMENT:maethor:120528: I can't find how to use it from template g.db.execute('delete from choices where id = ? and id_vote = ?', [choiceid, voteid]) g.db.commt() return redirect(url_for('admin_vote_edit', voteid=voteid)) @@ -401,6 +451,28 @@ def admin_vote_deletechoice(voteid, choiceid): g.db.commit() return redirect(url_for('admin_vote_edit', voteid=voteid)) +@app.route('/admin/votes/addattachment/', methods=['POST']) +def admin_vote_addattachment(voteid): + if not session.get('user').get('is_admin'): + abort(401) + vote = query_db('select * from votes where id = ?', [voteid], one=True) + if vote is None: + abort(404) + g.db.execute('insert into attachments (url, id_vote) values (?, ?)', [request.form['url'], voteid]) + g.db.commit() + return redirect(url_for('admin_vote_edit', voteid=voteid)) + +@app.route('/admin/votes/deleteattachment//') +def admin_vote_deleteattachment(voteid, attachmentid): + if not session.get('user').get('is_admin'): + abort(401) + attachment = query_db('select * from attachments where id = ? and id_vote = ?', [attachmentid, voteid], one=True) + if attachment is None: + abort(404) + g.db.execute('delete from attachments where id = ? and id_vote = ?', [attachmentid, voteid]) + g.db.commit() + return redirect(url_for('admin_vote_edit', voteid=voteid)) + #------ # Main