ignace/lapp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

group bugs and authorization improvements by codex

Browse Source
This commit is contained in:
ignace
2026-05-14 14:30:23 +02:00
parent a8554905ce
commit 0472ee1dd3
6 changed files with 98 additions and 50 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lists.py
+16 -7
View File
@@ -1,4 +1,4 @@
from flask import Blueprint, render_template, redirect, url_for, request, make_response
from flask import Blueprint, render_template, redirect, url_for, request, make_response, abort
from flask_login import login_required, current_user
from models import db
from models import User, ListOfItems, Item, Shared
@@ -32,17 +32,23 @@ def edit():
if request.method == "POST":
if "iid" in request.form:
ilist_id = int(request.form["iid"])
newname = request.form["name"]
ilist = db.get_or_404(ListOfItems, ilist_id)
if not current_user.owns_list(ilist_id):
abort(403)
newname = request.form["name"].strip()
double = False
for d in ListOfItems.query.filter_by(owner_user_id=current_user.id, name=newname).all():
if not d.id == ilist_id:
# there is a duplicate name
double = True
if double:
return render_template("lists_edit.html", user=current_user, ilists=current_user.my_owned_lists(with_inactive=True), newlist=newlist, error_id=ilist_id)
return render_template("lists_edit.html", user=current_user,
ilists=current_user.my_owned_lists(with_inactive=True),
users=not_current_user(current_user.id),
newlist=newlist, error_id=ilist_id)
# if id already exists, overwrite the existing list, else create a new one
ilist = ListOfItems.query.get(ilist_id)
if ilist:
# exists: delete OR overwrite shared data, activate data and update
if "to_be_deleted" in request.form:
@@ -68,12 +74,15 @@ def edit():
else:
# must be a new list
newlist = ListOfItems(name=request.form["name"], owner_user_id=current_user.id)
newlist = ListOfItems(name=request.form["name"].strip(), owner_user_id=current_user.id)
# check if name exists
duplicate = ListOfItems.query.filter_by(owner_user_id=current_user.id, name=request.form["name"]).first()
duplicate = ListOfItems.query.filter_by(owner_user_id=current_user.id, name=newlist.name).first()
if duplicate:
# there is a duplicate name
return render_template("lists_edit.html", user=current_user, ilists=current_user.my_owned_lists(with_inactive=True), newlist=newlist, error_id=9999)
return render_template("lists_edit.html", user=current_user,
ilists=current_user.my_owned_lists(with_inactive=True),
users=not_current_user(current_user.id),
newlist=newlist, error_id=9999)
newlist.is_active = True
newlist.owner_user_id = current_user.id