From 812b0de4d2839b892c7066c89e553d669b4cf41b Mon Sep 17 00:00:00 2001
From: Michael Tremer <michael.tremer@ipfire.org>
Date: Thu, 23 Jan 2025 20:54:34 +0000
Subject: [PATCH] mirrors: Fix editing and deleting mirrors

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
---
 src/templates/mirrors/delete.html | 12 +++---
 src/templates/mirrors/edit.html   | 28 ++++++-------
 src/web/mirrors.py                | 66 +++++++++++++------------------
 3 files changed, 47 insertions(+), 59 deletions(-)

diff --git a/src/templates/mirrors/delete.html b/src/templates/mirrors/delete.html
index 8961e1b1..1dd128f5 100644
--- a/src/templates/mirrors/delete.html
+++ b/src/templates/mirrors/delete.html
@@ -1,6 +1,6 @@
-{% extends "../modal.html" %}
+{% extends "modal.html" %}
 
-{% block title %}{{ _("Delete Mirror") }} - {{ mirror }}{% end block %}
+{% block title %}{{ _("Delete Mirror") }} - {{ mirror }}{% endblock %}
 
 {% block breadcrumbs %}
 	<nav class="breadcrumb" aria-label="breadcrumbs">
@@ -16,16 +16,16 @@
 			</li>
 		</ul>
 	</nav>
-{% end block %}
+{% endblock %}
 
 {% block modal_title %}
 	<h4 class="title is-4">{{ _("Delete Mirror") }}</h4>
 	<h6 class="subtitle is-6">{{ mirror }}</h6>
-{% end block %}
+{% endblock %}
 
 {% block modal %}
 	<form method="POST" action="">
-		{% raw xsrf_form_html() %}
+		{{ xsrf_form_html() | safe }}
 
 		<div class="content">
 			<p>
@@ -40,4 +40,4 @@
 			</button>
 		</div>
 	</form>
-{% end block %}
+{% endblock %}
diff --git a/src/templates/mirrors/edit.html b/src/templates/mirrors/edit.html
index 368e9512..f1df1daa 100644
--- a/src/templates/mirrors/edit.html
+++ b/src/templates/mirrors/edit.html
@@ -1,12 +1,12 @@
-{% extends "../modal.html" %}
+{% extends "modal.html" %}
 
 {% block title %}
 	{% if mirror %}
 		{{ _("Edit Mirror") }} - {{ mirror }}
 	{% else %}
 		{{ _("Create Mirror") }}
-	{% end %}
-{% end block %}
+	{% endif %}
+{% endblock %}
 
 {% block breadcrumbs %}
 	<nav class="breadcrumb" aria-label="breadcrumbs">
@@ -26,10 +26,10 @@
 				<li class="is-active">
 					<a href="#" aria-current="page">{{ _("Create") }}</a>
 				</li>
-			{% end %}
+			{% endif %}
 		</ul>
 	</nav>
-{% end block %}
+{% endblock %}
 
 {% block modal_title %}
 	{% if mirror %}
@@ -37,12 +37,12 @@
 		<h6 class="subtitle is-6">{{ mirror }}</h6>
 	{% else %}
 		<h4 class="title is-4">{{ _("Create A New Mirror") }}</h4>
-	{% end %}
-{% end block %}
+	{% endif %}
+{% endblock %}
 
 {% block modal %}
 	<form method="POST" action="">
-		{% raw xsrf_form_html() %}
+		{{ xsrf_form_html() | safe }}
 
 		{# Hostname & Path can only be set once #}
 		{% if not mirror %}
@@ -63,14 +63,14 @@
 						placeholder="{{ _("Path") }}" required>
 				</div>
 			</div>
-		{% end %}
+		{% endif %}
 
 		{# Owner #}
 		<div class="field">
 			<label class="label">{{ _("Owner") }}</label>
 			<div class="control">
 				<input class="input" type="text" name="owner"
-					{% if mirror %}value="{{ mirror.owner }}"{% end %}
+					{% if mirror %}value="{{ mirror.owner }}"{% endif %}
 					placeholder="{{ _("Owner") }}" required>
 			</div>
 		</div>
@@ -80,7 +80,7 @@
 			<label class="label">{{ _("Contact Email Address") }}</label>
 			<div class="control">
 				<input class="input" type="email" name="contact"
-					{% if mirror %}value="{{ mirror.contact }}"{% end %}
+					{% if mirror %}value="{{ mirror.contact }}"{% endif %}
 					placeholder="{{ _("Contact Email Address") }}" required>
 			</div>
 		</div>
@@ -90,7 +90,7 @@
 			<label class="label">{{ _("Notes") }}</label>
 			<div class="control">
 				<textarea class="textarea" name="notes" rows="8"
-					>{% if mirror %}{{ mirror.notes }}{% end %}</textarea>
+					>{% if mirror %}{{ mirror.notes }}{% endif %}</textarea>
 			</div>
 		</div>
 
@@ -104,7 +104,7 @@
 				<button type="submit" class="button is-success is-fullwidth">
 					{{ _("Create Mirror") }}
 				</button>
-			{% end %}
+			{% endif %}
 		</div>
 	</form>
-{% end block %}
+{% endblock %}
diff --git a/src/web/mirrors.py b/src/web/mirrors.py
index 0888aae4..f329537a 100644
--- a/src/web/mirrors.py
+++ b/src/web/mirrors.py
@@ -37,34 +37,22 @@ class CheckHandler(base.BaseHandler):
 		await self.redirect("/mirrors/%s" % mirror.hostname)
 
 
-class CreateHandler(base.BaseHandler):
-	def prepare(self):
-		# Admin permissions are required
-		if not self.current_user.is_admin():
-			raise tornado.web.HTTPError(403)
-
+class CreateHandler(base.AdminHandler):
 	@base.authenticated
-	def get(self):
-		self.render("mirrors/edit.html", mirror=None)
+	async def get(self):
+		await self.render("mirrors/edit.html", mirror=None)
 
 	@base.authenticated
 	async def post(self):
-		# Fetch all values
-		hostname = self.get_argument("hostname")
-		path     = self.get_argument("path")
-		owner    = self.get_argument("owner")
-		contact  = self.get_argument("contact")
-		notes    = self.get_argument("notes", None)
-
 		# Create the mirror
-		with self.db.transaction():
-			mirror = await self.backend.mirrors.create(
-				hostname,
-				path,
-				owner,
-				contact,
-				user=self.current_user,
-			)
+		mirror = await self.backend.mirrors.create(
+			hostname = self.get_argument("hostname"),
+			path     = self.get_argument("path"),
+			owner    = self.get_argument("owner"),
+			contact  = self.get_argument("contact"),
+			notes    = self.get_argument("notes", ""),
+			user     = self.current_user,
+		)
 
 		# Redirect the user back
 		self.redirect("/mirrors/%s" % mirror.hostname)
@@ -72,8 +60,8 @@ class CreateHandler(base.BaseHandler):
 
 class EditHandler(base.BaseHandler):
 	@base.authenticated
-	def get(self, hostname):
-		mirror = self.backend.mirrors.get_by_hostname(hostname)
+	async def get(self, hostname):
+		mirror = await self.backend.mirrors.get_by_hostname(hostname)
 		if not mirror:
 			raise tornado.web.HTTPError(404, "Could not find mirror %s" % hostname)
 
@@ -81,11 +69,11 @@ class EditHandler(base.BaseHandler):
 		if not mirror.has_perm(self.current_user):
 			raise tornado.web.HTTPError(403)
 
-		self.render("mirrors/edit.html", mirror=mirror)
+		await self.render("mirrors/edit.html", mirror=mirror)
 
 	@base.authenticated
-	def post(self, hostname):
-		mirror = self.backend.mirrors.get_by_hostname(hostname)
+	async def post(self, hostname):
+		mirror = await self.backend.mirrors.get_by_hostname(hostname)
 		if not mirror:
 			raise tornado.web.HTTPError(404, "Could not find mirror %s" % hostname)
 
@@ -93,18 +81,18 @@ class EditHandler(base.BaseHandler):
 		if not mirror.has_perm(self.current_user):
 			raise tornado.web.HTTPError(403)
 
-		with self.db.transaction():
-			mirror.owner          = self.get_argument("owner")
-			mirror.contact        = self.get_argument("contact")
-			mirror.notes          = self.get_argument("notes", None)
+		# Store new values
+		mirror.owner          = self.get_argument("owner")
+		mirror.contact        = self.get_argument("contact")
+		mirror.notes          = self.get_argument("notes", None)
 
 		self.redirect("/mirrors/%s" % mirror.hostname)
 
 
 class DeleteHandler(base.BaseHandler):
 	@base.authenticated
-	def get(self, hostname):
-		mirror = self.backend.mirrors.get_by_hostname(hostname)
+	async def get(self, hostname):
+		mirror = await self.backend.mirrors.get_by_hostname(hostname)
 		if not mirror:
 			raise tornado.web.HTTPError(404, "Could not find mirror %s" % hostname)
 
@@ -112,11 +100,11 @@ class DeleteHandler(base.BaseHandler):
 		if not mirror.has_perm(self.current_user):
 			raise tornado.web.HTTPError(403)
 
-		self.render("mirrors/delete.html", mirror=mirror)
+		await self.render("mirrors/delete.html", mirror=mirror)
 
 	@base.authenticated
-	def post(self, hostname):
-		mirror = self.backend.mirrors.get_by_hostname(hostname)
+	async def post(self, hostname):
+		mirror = await self.backend.mirrors.get_by_hostname(hostname)
 		if not mirror:
 			raise tornado.web.HTTPError(404, "Could not find mirror %s" % hostname)
 
@@ -124,8 +112,8 @@ class DeleteHandler(base.BaseHandler):
 		if not mirror.has_perm(self.current_user):
 			raise tornado.web.HTTPError(403)
 
-		with self.db.transaction():
-			mirror.delete(user=self.current_user)
+		# Delete the mirror
+		await mirror.delete(deleted_by=self.current_user)
 
 		# Redirect back to all mirrors
 		self.redirect("/mirrors")
-- 
2.47.3