diff options
Diffstat (limited to 'server')
| -rw-r--r-- | server/config.yaml.dist | 2 | ||||
| -rw-r--r-- | server/szurubooru/api/post_api.py | 4 | ||||
| -rw-r--r-- | server/szurubooru/search/configs/post_search_config.py | 30 | ||||
| -rw-r--r-- | server/szurubooru/tests/api/test_post_retrieving.py | 3 | ||||
| -rw-r--r-- | server/szurubooru/tests/search/configs/test_post_search_config.py | 1 | ||||
| -rw-r--r-- | server/szurubooru/tests/search/test_executor.py | 5 |
6 files changed, 32 insertions, 13 deletions
diff --git a/server/config.yaml.dist b/server/config.yaml.dist index 9a41295..b373502 100644 --- a/server/config.yaml.dist +++ b/server/config.yaml.dist @@ -97,10 +97,12 @@ privileges: 'posts:create:anonymous': regular 'posts:create:identified': regular 'posts:list': anonymous + 'posts:list:sketchy': regular 'posts:list:unsafe': regular 'posts:reverse_search': regular 'posts:view': anonymous 'posts:view:featured': anonymous + 'posts:view:sketchy': regular 'posts:view:unsafe': regular 'posts:edit:content': power 'posts:edit:flags': regular diff --git a/server/szurubooru/api/post_api.py b/server/szurubooru/api/post_api.py index 4e89f54..7ede06c 100644 --- a/server/szurubooru/api/post_api.py +++ b/server/szurubooru/api/post_api.py @@ -117,7 +117,9 @@ def create_snapshots_for_post( def get_post(ctx: rest.Context, params: Dict[str, str]) -> rest.Response: auth.verify_privilege(ctx.user, "posts:view") post = _get_post(params) - if post.safety == model.Post.SAFETY_UNSAFE: + if post.safety == model.Post.SAFETY_SKETCHY: + auth.verify_privilege(ctx.user, "posts:view:sketchy") + elif post.safety == model.Post.SAFETY_UNSAFE: auth.verify_privilege(ctx.user, "posts:view:unsafe") return _serialize_post(ctx, post) diff --git a/server/szurubooru/search/configs/post_search_config.py b/server/szurubooru/search/configs/post_search_config.py index 9065539..5bf95d7 100644 --- a/server/szurubooru/search/configs/post_search_config.py +++ b/server/szurubooru/search/configs/post_search_config.py @@ -256,6 +256,15 @@ def _safety_filter( )(query, criterion, negated) +def _apply_safety_filter( + query: SaQuery, safety: str, negated: bool +) -> SaQuery: + expr = model.Post.safety == safety + if negated: + expr = ~expr + return query.filter(expr) + + class PostSearchConfig(BaseSearchConfig): def __init__(self) -> None: self.user = None # type: Optional[model.User] @@ -320,17 +329,16 @@ class PostSearchConfig(BaseSearchConfig): return db.session.query(model.Post) def finalize_query(self, query: SaQuery) -> SaQuery: - if self.user and not auth.has_privilege( - self.user, "posts:list:unsafe" - ): - # exclude unsafe posts: - query = _safety_filter( - query, - criteria.PlainCriterion( - model.Post.SAFETY_UNSAFE, model.Post.SAFETY_UNSAFE - ), - negated=True, - ) + # exclude posts according to user's privileges: + if self.user: + if not auth.has_privilege(self.user, "posts:list:sketchy"): + query = _apply_safety_filter( + query, model.Post.SAFETY_SKETCHY, negated=True + ) + if not auth.has_privilege(self.user, "posts:list:unsafe"): + query = _apply_safety_filter( + query, model.Post.SAFETY_UNSAFE, negated=True + ) return query.order_by(model.Post.post_id.desc()) @property diff --git a/server/szurubooru/tests/api/test_post_retrieving.py b/server/szurubooru/tests/api/test_post_retrieving.py index 0e9e918..d66a1f5 100644 --- a/server/szurubooru/tests/api/test_post_retrieving.py +++ b/server/szurubooru/tests/api/test_post_retrieving.py @@ -16,7 +16,9 @@ def inject_config(config_injector): "privileges": { "posts:list": model.User.RANK_REGULAR, "posts:view": model.User.RANK_REGULAR, + "posts:view:sketchy": model.User.RANK_REGULAR, "posts:view:unsafe": model.User.RANK_REGULAR, + "posts:list:sketchy": model.User.RANK_REGULAR, "posts:list:unsafe": model.User.RANK_REGULAR, }, } @@ -188,6 +190,7 @@ def test_trying_to_retrieve_unsafe_without_privileges( { "privileges": { "posts:view": "anonymous", + "posts:view:sketchy": "regular", "posts:view:unsafe": "regular", }, } diff --git a/server/szurubooru/tests/search/configs/test_post_search_config.py b/server/szurubooru/tests/search/configs/test_post_search_config.py index f04dabc..9f59b54 100644 --- a/server/szurubooru/tests/search/configs/test_post_search_config.py +++ b/server/szurubooru/tests/search/configs/test_post_search_config.py @@ -64,6 +64,7 @@ def auth_executor(executor, user_factory, config_injector): config_injector( { "privileges": { + "posts:list:sketchy": model.User.RANK_REGULAR, "posts:list:unsafe": model.User.RANK_REGULAR, } } diff --git a/server/szurubooru/tests/search/test_executor.py b/server/szurubooru/tests/search/test_executor.py index 5c52f72..21817c1 100644 --- a/server/szurubooru/tests/search/test_executor.py +++ b/server/szurubooru/tests/search/test_executor.py @@ -10,7 +10,10 @@ from szurubooru.func import cache def inject_config(config_injector): config_injector( { - "privileges": {"posts:list:unsafe": model.User.RANK_REGULAR}, + "privileges": { + "posts:list:sketchy": model.User.RANK_REGULAR, + "posts:list:unsafe": model.User.RANK_REGULAR, + }, } ) |