Added metas to vote view, added attachments table

[cavote.git] / main.py

diff --git a/main.py b/main.py
index bdbd032..8c050b8 100755 (executable)
--- a/main.py
+++ b/main.py
@@ -165,6 +165,41 @@ def add_user():
             flash(u"Vous devez spécifier une adresse email.", 'error')
     return render_template('add_user.html')
 
+#-------------
+# Roles admin
+
+@app.route('/roles')
+def show_roles():
+    if not session.get('user').get('is_admin'):
+        abort(401)
+    roles = query_db('select * from roles')
+    return render_template('show_roles.html', roles=roles)
+
+@app.route('/roles/admin/add', methods=['POST'])
+def add_role():
+    if not session.get('user').get('is_admin'):
+        abort(401)
+    if request.method == 'POST':
+        if request.form['name']:
+            g.db.execute('insert into roles (name) values (?)', [request.form['name']])
+            g.db.commit()
+        else:
+            flash(u"Vous devez spécifier un nom.", "error")
+    return redirect(url_for('show_roles'))
+
+@app.route('/roles/admin/delete/<idrole>')
+def del_role(idrole):
+    if not session.get('user').get('is_admin'):
+        abort(401)
+    role = query_db('select * from roles where id = ?', [idrole], one=True)
+    if role is None:
+        abort(404)
+    if role['system']:
+        abort(401)
+    g.db.execute('delete from roles where id = ?', [idrole])
+    g.db.commit()
+    return redirect(url_for('show_roles'))
+
 #------------
 # Votes list
 
@@ -172,15 +207,42 @@ def add_user():
 def show_votes(votes):
     today = date.today()
     if votes == 'all':
-        votes = query_db('select title, description, date_begin, date_end from votes order by id desc')
+        votes = query_db('select * from votes order by id desc')
     elif votes == 'archive':
-        votes = query_db('select title, description, date_begin, date_end from votes where date_end < (?) order by id desc', [today])
+        votes = query_db('select * from votes where date_end < (?) order by id desc', [today])
     elif votes == 'current':
-        votes = query_db('select title, description, date_begin, date_end from votes where date_end >= (?) order by id desc', [today])
+        votes = query_db('select * from votes where date_end >= (?) order by id desc', [today])
     else:
         abort(404)
     return render_template('show_votes.html', votes=votes)
 
+#------
+# Vote
+
+def can_see_vote(idvote, iduser=-1):
+    user = query_db('select * from users where id=?', [iduser], one=True)
+    vote = query_db('select * from votes where id=?', [idvote], one=True)
+    if user is None and not vote.is_public:
+        return False
+    return True # :TODO:maethor:20120529: Check others things
+
+def can_vote(idvote, iduser=-1):
+    if not can_see_vote(idvote, iduser):
+        return False
+    return True # :TODO:maethor:20120529: Check others things
+
+@app.route('/vote/<idvote>')
+def show_vote(idvote):
+    vote = query_db('select *, roles.name as rolename from votes join roles on roles.id=votes.id_role where votes.id=?', [idvote], one=True)
+    if vote is None:
+        abort(404)
+    if can_see_vote(idvote, session.get('user').get('id')):
+        choices = query_db('select * from choices where id_vote=?', [idvote])
+        attachments = query_db('select * from attachments where id_vote=?', [idvote])
+        return render_template('vote.html', vote=vote, attachments=attachments, choices=choices, can_vote=can_vote(idvote, session.get('user').get('id')))
+    flash('Vous n\'avez pas le droit de voir ce vote, désolé.')
+    return(url_for('home'))
+
 #-------------
 # Votes admin
 
@@ -237,7 +299,7 @@ def edit_vote(voteid):
             if 'public' in request.form.keys():
                 public = 1
             isopen = 0
-            if request.form['status'] == 'Ouvert':
+            if request.form['status'] == 'Ouvert': # :TODO:maethor:20120529: Check if there is at least 2 choices before
                 isopen = 1
             g.db.execute('update votes set title = ?, description = ?, category = ?, is_transparent = ?, is_public = ?, is_open = ? where id = ?',
                     [request.form['title'], request.form['description'], request.form['category'], transparent, public, isopen, voteid])