group bugs and authorization improvements by codex

items.py

@@ -1,7 +1,7 @@
-from flask import Blueprint, render_template, redirect, url_for, request, make_response
+from flask import Blueprint, render_template, redirect, url_for, request, make_response, abort
 from flask_login import login_required, current_user
 from models import db
-from models import Item
+from models import Item, ListOfItems
 from sqlalchemy import desc, text
 import os
 from log import Log
@@ -11,10 +11,23 @@ items_bp = Blueprint("items", __name__)
 
 ICONPATH = "static/categories/"  #without starting / and with ending /
 
+def require_list_access(listid):
+    listofitem = db.get_or_404(ListOfItems, int(listid))
+    if not current_user.can_access_list(listofitem.id):
+        abort(403)
+    return listofitem
+
+def require_item_access(itemid):
+    item = db.get_or_404(Item, int(itemid))
+    if not current_user.can_access_item(item.id):
+        abort(403)
+    return item
+
 # home screen for items
 @items_bp.route("/items/<listid>")
 @login_required
 def items(listid):
+    require_list_access(listid)
     resp = make_response(render_template("items_show.html", user=current_user, 
                            items=Item.query.filter_by(listofitems_id=listid, is_suggestion=False).order_by(text("is_checked, category, label")).all(),
                            button_top_url1 = url_for("items.items_append", listid=listid),
@@ -28,7 +41,7 @@ def items(listid):
 @items_bp.route("/item_update/<itemid>/<itemchecked>")
 @login_required
 def item_update(itemid, itemchecked):
-    i = Item.query.get(itemid)
+    i = require_item_access(itemid)
     i.is_checked = True if itemchecked == 'true' else False
     db.session.commit()
     return '', 204
@@ -115,6 +128,7 @@ def interpret_and_add_item(listid, newlabel):
 @items_bp.route("/items_append/<listid>", methods=["GET", "POST"])
 @login_required
 def items_append(listid):
+    require_list_access(listid)
     if request.method == "POST":
         # a new item has been added
         newlabel = request.form["newItem"]
@@ -140,6 +154,7 @@ def items_append(listid):
 @items_bp.route("/items_multiappend/<listid>", methods=["GET", "POST"])
 @login_required
 def items_multiappend(listid):
+    require_list_access(listid)
     if request.method == "POST":
         # a new item has been added
         newitems = request.form["newItems"]
@@ -154,7 +169,7 @@ def items_multiappend(listid):
 @items_bp.route("/item_delete/<itemid>")
 @login_required
 def item_delete(itemid):
-    i = Item.query.get(itemid)
+    i = require_item_access(itemid)
     listid = i.listofitems_id
     db.session.delete(i)
     db.session.commit()
@@ -169,6 +184,7 @@ def item_delete(itemid):
 @items_bp.route("/items_clean/<listid>")
 @login_required
 def items_clean(listid):
+    require_list_access(listid)
     for i in Item.query.filter_by(listofitems_id=listid, is_checked=True, is_suggestion=False).all():
         i.is_suggestion = True
     db.session.commit()
@@ -178,7 +194,7 @@ def items_clean(listid):
 @items_bp.route("/item_addone/<itemid>")
 @login_required
 def item_addone(itemid):
-    i = Item.query.get(itemid)
+    i = require_item_access(itemid)
     listid = i.listofitems_id
     # if it is checked or not on the list yet, set quantity to one 
     if i.is_suggestion or i.is_checked:
@@ -204,7 +220,7 @@ def item_addone(itemid):
 @items_bp.route("/item_addquantity/<itemid>/<quantity>")
 @login_required
 def item_addquantity(itemid, quantity):
-    i = Item.query.get(itemid)
+    i = require_item_access(itemid)
     listid = i.listofitems_id
     # always add the item to the active todo
     if i.is_suggestion or i.is_checked:
@@ -225,7 +241,7 @@ def item_addquantity(itemid, quantity):
 @items_bp.route("/item_update_category/<itemid>/<category>")
 @login_required
 def item_upitem_update_categorydate(itemid, category):
-    i = Item.query.get(itemid)
+    i = require_item_access(itemid)
     i.category = category
     db.session.commit()
-    return '', 204
+    return '', 204