CSRF protection. #361

[zzz-spline-forum.git] / splinext / forum / controllers / forum.py

diff --git a/splinext/forum/controllers/forum.py b/splinext/forum/controllers/forum.py
index 5d962e0..f2eb476 100644 (file)
--- a/splinext/forum/controllers/forum.py
+++ b/splinext/forum/controllers/forum.py
@@ -4,6 +4,7 @@ import math
 
 from pylons import cache, config, request, response, session, tmpl_context as c, url
 from pylons.controllers.util import abort, redirect
+from pylons.decorators.secure import authenticate_form
 from routes import request_config
 from sqlalchemy.orm import joinedload
 from sqlalchemy.orm.exc import NoResultFound
@@ -147,10 +148,21 @@ class ForumController(BaseController):
 
         c.write_thread_form = WriteThreadForm()
 
-        c.threads = c.forum.threads.options(
-            joinedload('last_post'),
-            joinedload('last_post.author'),
-        )
+        # nb: This will never show post-less threads.  Oh well!
+        threads_q = c.forum.threads \
+            .join(forum_model.Thread.last_post) \
+            .order_by(forum_model.Post.posted_time.desc()) \
+            .options(
+                joinedload('last_post'),
+                joinedload('last_post.author'),
+            )
+        c.num_threads = threads_q.count()
+        try:
+            c.skip = int(request.params.get('skip', 0))
+        except ValueError:
+            abort(404)
+        c.per_page = 89
+        c.threads = threads_q.offset(c.skip).limit(c.per_page)
 
         return render('/forum/threads.mako')
 
@@ -163,6 +175,17 @@ class ForumController(BaseController):
 
         c.write_post_form = WritePostForm()
 
+        posts_q = c.thread.posts \
+            .order_by(forum_model.Post.position.asc()) \
+            .options(joinedload('author'))
+        c.num_posts = c.thread.post_count
+        try:
+            c.skip = int(request.params.get('skip', 0))
+        except ValueError:
+            abort(404)
+        c.per_page = 89
+        c.posts = posts_q.offset(c.skip).limit(c.per_page)
+
         return render('/forum/posts.mako')
 
 
@@ -178,11 +201,25 @@ class ForumController(BaseController):
             abort(404)
 
         c.write_thread_form = WriteThreadForm(request.params)
+        return render('/forum/write_thread.mako')
 
-        if request.method != 'POST' or not c.write_thread_form.validate():
-            # Failure or initial request; show the form
-            return render('/forum/write_thread.mako')
+    @authenticate_form
+    def write_thread_commit(self, forum_id):
+        """Posts a new thread."""
+        if not c.user.can('forum:create-thread'):
+            abort(403)
+
+        try:
+            c.forum = meta.Session.query(forum_model.Forum) \
+                .filter_by(id=forum_id).one()
+        except NoResultFound:
+            abort(404)
+
+        c.write_thread_form = WriteThreadForm(request.params)
 
+        # Reshow the form on failure
+        if not c.write_thread_form.validate():
+            return render('/forum/write_thread.mako')
 
         # Otherwise, add the post.
         c.forum = meta.Session.query(forum_model.Forum) \
@@ -227,11 +264,25 @@ class ForumController(BaseController):
             abort(404)
 
         c.write_post_form = WritePostForm(request.params)
+        return render('/forum/write.mako')
 
-        if request.method != 'POST' or not c.write_post_form.validate():
-            # Failure or initial request; show the form
-            return render('/forum/write.mako')
+    @authenticate_form
+    def write_commit(self, forum_id, thread_id):
+        """Post to a thread."""
+        if not c.user.can('forum:create-post'):
+            abort(403)
+
+        try:
+            c.thread = meta.Session.query(forum_model.Thread) \
+                .filter_by(id=thread_id, forum_id=forum_id).one()
+        except NoResultFound:
+            abort(404)
+
+        c.write_post_form = WritePostForm(request.params)
 
+        # Reshow the form on failure
+        if not c.write_post_form.validate():
+            return render('/forum/write.mako')
 
         # Otherwise, add the post.
         c.thread = meta.Session.query(forum_model.Thread) \