Drop checking URL blacklists to block users

[ipfire.org.git] / src / web / blog.py

#!/usr/bin/python

import datetime
import dateutil
import email.utils
import tornado.web

from . import auth
from . import base
from . import ui_modules

class IndexHandler(auth.CacheMixin, base.BaseHandler):
	def get(self):
		posts = self.backend.blog.get_newest(limit=3)

		# Allow this to be cached for 5 minutes
		if not self.current_user:
			self.set_expires(300)

		self.render("blog/index.html", posts=posts)


class AuthorHandler(auth.CacheMixin, base.BaseHandler):
	def get(self, uid):
		author = self.accounts.get_by_uid(uid)
		if not author:
			raise tornado.web.HTTPError(404, "User is unknown")

		# Get all posts from this author
		posts = self.backend.blog.get_by_author(author)
		if not posts:
			raise tornado.web.HTTPError(404, "User has no posts")

		# Allow this to be cached for 10 minutes
		if not self.current_user:
			self.set_expires(600)

		self.render("blog/author.html", author=author, posts=posts)


class FeedHandler(base.BaseHandler):
	def get(self):
		posts = self.backend.blog.get_newest(limit=10)
		if not posts:
			raise tornado.web.HTTPError(404)

		# Allow this to be cached for 10 minutes
		self.set_expires(600)

		# Set correct content type
		self.set_header("Content-Type", "application/rss+xml")

		# Render the feed
		self.render("blog/feed.xml", posts=posts,
			now=email.utils.formatdate())


class PostHandler(auth.CacheMixin, base.BaseHandler):
	def get(self, slug):
		post = self.backend.blog.get_by_slug(slug, published=not self.current_user)
		if not post:
			raise tornado.web.HTTPError(404)

		# Allow this to be cached for 10 minutes
		if post.is_published():
			self.set_expires(600)

		self.render("blog/post.html", post=post)


class PublishHandler(auth.CacheMixin, base.BaseHandler):
	@tornado.web.authenticated
	def get(self, slug):
		post = self.backend.blog.get_by_slug(slug, published=False)
		if not post:
			raise tornado.web.HTTPError(404)

		# Check if current_user is allowed to edit the post
		if not post.is_editable(self.current_user):
			raise tornado.web.HTTPError(403)

		# Is the post already published?
		if post.is_published():
			raise tornado.web.HTTPError(400, "Post is already published")

		self.render("blog/publish.html", post=post)

	@tornado.web.authenticated
	def post(self, slug):
		post = self.backend.blog.get_by_slug(slug, published=False)
		if not post:
			raise tornado.web.HTTPError(404)

		# Check if current_user is allowed to edit the post
		if not post.is_editable(self.current_user):
			raise tornado.web.HTTPError(403)

		# Is the post already published?
		if post.is_published():
			raise tornado.web.HTTPError(400, "Post is already published")

		when = self.get_argument("when", None)
		if when:
			when = dateutil.parser.parse(when)

		# Publish the post
		with self.db.transaction():
			post.publish(when)

		self.redirect("/post/%s" % post.slug)


class DraftsHandler(auth.CacheMixin, base.BaseHandler):
	@tornado.web.authenticated
	def get(self):
		drafts = self.backend.blog.get_drafts(author=self.current_user)

		self.render("blog/drafts.html", drafts=drafts)


class SearchHandler(auth.CacheMixin, base.BaseHandler):
	def get(self):
		q = self.get_argument("q")

		posts = self.backend.blog.search(q, limit=50)
		if not posts:
			raise tornado.web.HTTPError(404, "Nothing found")

		self.render("blog/search-results.html", q=q, posts=posts)


class TagHandler(auth.CacheMixin, base.BaseHandler):
	def get(self, tag):
		posts = self.backend.blog.get_by_tag(tag)
		if not posts:
			raise tornado.web.HTTPError(404, "There are no posts with tag: %s" % tag)

		# Allow this to be cached for 10 minutes
		self.set_expires(600)

		self.render("blog/tag.html", posts=list(posts), tag=tag)


class YearHandler(auth.CacheMixin, base.BaseHandler):
	def get(self, year):
		posts = self.backend.blog.get_by_year(year)
		if not posts:
			raise tornado.web.HTTPError(404, "There are no posts in %s" % year)

		# Allow this to be cached for 10 minutes
		self.set_expires(600)

		self.render("blog/year.html", posts=posts, year=year)


class ComposeHandler(auth.CacheMixin, base.BaseHandler):
	@tornado.web.authenticated
	def get(self):
		self.render("blog/compose.html", post=None)

	@tornado.web.authenticated
	def post(self):
		title = self.get_argument("title")
		text  = self.get_argument("text")
		tags  = self.get_argument("tags", "").split(" ")

		with self.db.transaction():
			post = self.backend.blog.create_post(title, text,
				author=self.current_user, tags=tags)

		self.redirect("/drafts")


class EditHandler(auth.CacheMixin, base.BaseHandler):
	@tornado.web.authenticated
	def get(self, slug):
		post = self.backend.blog.get_by_slug(slug, published=False)
		if not post:
			raise tornado.web.HTTPError(404)

		# Check if post is editable
		if not post.is_editable(self.current_user):
			raise tornado.web.HTTPError(403, "%s cannot edit %s" % (self.current_user, post))

		self.render("blog/compose.html", post=post)

	@tornado.web.authenticated
	def post(self, slug):
		post = self.backend.blog.get_by_slug(slug, published=False)
		if not post:
			raise tornado.web.HTTPError(404)

		# Check if post is editable
		if not post.is_editable(self.current_user):
			raise tornado.web.HTTPError(403, "%s cannot edit %s" % (self.current_user, post))

		# Save updated content
		with self.db.transaction():
			post.update(
				title = self.get_argument("title"),
				text  = self.get_argument("text"),
				tags  = self.get_argument("tags", "").split(" "),
			)

		# Return to blog if the post is already published
		if post.is_published():
			self.redirect("/post/%s" % post.slug)
			return

		# Otherwise return to drafts
		self.redirect("/drafts")


class DeleteHandler(auth.CacheMixin, base.BaseHandler):
	@tornado.web.authenticated
	def get(self, slug):
		post = self.backend.blog.get_by_slug(slug, published=False)
		if not post:
			raise tornado.web.HTTPError(404)

		# Check if post is editable
		if not post.is_editable(self.current_user):
			raise tornado.web.HTTPError(403, "%s cannot edit %s" % (self.current_user, post))

		self.render("blog/delete.html", post=post)

	@tornado.web.authenticated
	def post(self, slug):
		post = self.backend.blog.get_by_slug(slug, published=False)
		if not post:
			raise tornado.web.HTTPError(404)

		# Check if post is editable
		if not post.is_editable(self.current_user):
			raise tornado.web.HTTPError(403, "%s cannot edit %s" % (self.current_user, post))

		with self.db.transaction():
			post.delete()

		# Return to drafts
		self.redirect("/drafts")


class HistoryNavigationModule(ui_modules.UIModule):
	def render(self):
		return self.render_string("blog/modules/history-navigation.html",
			years=self.backend.blog.years)


class ListModule(ui_modules.UIModule):
	def render(self, posts):
		return self.render_string("blog/modules/list.html", posts=posts)


class PostModule(ui_modules.UIModule):
	def render(self, post):
		return self.render_string("blog/modules/post.html", post=post)


class PostsModule(ui_modules.UIModule):
	def render(self, posts):
		return self.render_string("blog/modules/posts.html", posts=list(posts))