diff options
Diffstat (limited to 'server/szurubooru')
5 files changed, 30 insertions, 13 deletions
diff --git a/server/szurubooru/api/post_api.py b/server/szurubooru/api/post_api.py index 4e89f54..7ede06c 100644 --- a/server/szurubooru/api/post_api.py +++ b/server/szurubooru/api/post_api.py @@ -117,7 +117,9 @@ def create_snapshots_for_post( def get_post(ctx: rest.Context, params: Dict[str, str]) -> rest.Response: auth.verify_privilege(ctx.user, "posts:view") post = _get_post(params) - if post.safety == model.Post.SAFETY_UNSAFE: + if post.safety == model.Post.SAFETY_SKETCHY: + auth.verify_privilege(ctx.user, "posts:view:sketchy") + elif post.safety == model.Post.SAFETY_UNSAFE: auth.verify_privilege(ctx.user, "posts:view:unsafe") return _serialize_post(ctx, post) diff --git a/server/szurubooru/search/configs/post_search_config.py b/server/szurubooru/search/configs/post_search_config.py index 9065539..5bf95d7 100644 --- a/server/szurubooru/search/configs/post_search_config.py +++ b/server/szurubooru/search/configs/post_search_config.py @@ -256,6 +256,15 @@ def _safety_filter( )(query, criterion, negated) +def _apply_safety_filter( + query: SaQuery, safety: str, negated: bool +) -> SaQuery: + expr = model.Post.safety == safety + if negated: + expr = ~expr + return query.filter(expr) + + class PostSearchConfig(BaseSearchConfig): def __init__(self) -> None: self.user = None # type: Optional[model.User] @@ -320,17 +329,16 @@ class PostSearchConfig(BaseSearchConfig): return db.session.query(model.Post) def finalize_query(self, query: SaQuery) -> SaQuery: - if self.user and not auth.has_privilege( - self.user, "posts:list:unsafe" - ): - # exclude unsafe posts: - query = _safety_filter( - query, - criteria.PlainCriterion( - model.Post.SAFETY_UNSAFE, model.Post.SAFETY_UNSAFE - ), - negated=True, - ) + # exclude posts according to user's privileges: + if self.user: + if not auth.has_privilege(self.user, "posts:list:sketchy"): + query = _apply_safety_filter( + query, model.Post.SAFETY_SKETCHY, negated=True + ) + if not auth.has_privilege(self.user, "posts:list:unsafe"): + query = _apply_safety_filter( + query, model.Post.SAFETY_UNSAFE, negated=True + ) return query.order_by(model.Post.post_id.desc()) @property diff --git a/server/szurubooru/tests/api/test_post_retrieving.py b/server/szurubooru/tests/api/test_post_retrieving.py index 0e9e918..d66a1f5 100644 --- a/server/szurubooru/tests/api/test_post_retrieving.py +++ b/server/szurubooru/tests/api/test_post_retrieving.py @@ -16,7 +16,9 @@ def inject_config(config_injector): "privileges": { "posts:list": model.User.RANK_REGULAR, "posts:view": model.User.RANK_REGULAR, + "posts:view:sketchy": model.User.RANK_REGULAR, "posts:view:unsafe": model.User.RANK_REGULAR, + "posts:list:sketchy": model.User.RANK_REGULAR, "posts:list:unsafe": model.User.RANK_REGULAR, }, } @@ -188,6 +190,7 @@ def test_trying_to_retrieve_unsafe_without_privileges( { "privileges": { "posts:view": "anonymous", + "posts:view:sketchy": "regular", "posts:view:unsafe": "regular", }, } diff --git a/server/szurubooru/tests/search/configs/test_post_search_config.py b/server/szurubooru/tests/search/configs/test_post_search_config.py index f04dabc..9f59b54 100644 --- a/server/szurubooru/tests/search/configs/test_post_search_config.py +++ b/server/szurubooru/tests/search/configs/test_post_search_config.py @@ -64,6 +64,7 @@ def auth_executor(executor, user_factory, config_injector): config_injector( { "privileges": { + "posts:list:sketchy": model.User.RANK_REGULAR, "posts:list:unsafe": model.User.RANK_REGULAR, } } diff --git a/server/szurubooru/tests/search/test_executor.py b/server/szurubooru/tests/search/test_executor.py index 5c52f72..21817c1 100644 --- a/server/szurubooru/tests/search/test_executor.py +++ b/server/szurubooru/tests/search/test_executor.py @@ -10,7 +10,10 @@ from szurubooru.func import cache def inject_config(config_injector): config_injector( { - "privileges": {"posts:list:unsafe": model.User.RANK_REGULAR}, + "privileges": { + "posts:list:sketchy": model.User.RANK_REGULAR, + "posts:list:unsafe": model.User.RANK_REGULAR, + }, } ) |