From a213396854856aad0bde64758c2a0435aa5f5c10 Mon Sep 17 00:00:00 2001 From: justcool393 Date: Sat, 17 Dec 2022 09:11:51 -0800 Subject: [PATCH] Solve blocking weaponization. * allow anyone to reply to their blockers * revert userblocks thing * get rid of unnecessary template * make blocking page accurate * comment author things * fix prev commit * fix block page * comma splice Co-authored-by: Snakes <104547575+TLSM@users.noreply.github.com> --- files/assets/js/comments_v.js | 8 ++++++-- files/classes/user.py | 9 ++++++++- files/routes/comments.py | 18 ++++++++++++------ files/routes/users.py | 18 ------------------ files/templates/settings_blocks.html | 21 +-------------------- files/templates/userpage_blocked.html | 24 ------------------------ 6 files changed, 27 insertions(+), 71 deletions(-) delete mode 100644 files/templates/userpage_blocked.html diff --git a/files/assets/js/comments_v.js b/files/assets/js/comments_v.js index 2440a46f1..0ceb03dab 100644 --- a/files/assets/js/comments_v.js +++ b/files/assets/js/comments_v.js @@ -315,8 +315,12 @@ function post_comment(fullname,id,level = 1){ replyArea.classList.add('d-none'); } } - } - else { + + if (data["message"]) { + document.getElementById("toast-post-success-text").innerText = data["message"]; + bootstrap.Toast.getOrCreateInstance(document.getElementById("toast-post-success")).show(); + } + } else { if (data && data["error"]) document.getElementById('toast-post-error-text').innerText = data["error"]; if (data && data["details"]) document.getElementById('toast-post-error-text').innerText = data["details"]; else document.getElementById('toast-post-error-text').innerText = "Error, please try again later." diff --git a/files/classes/user.py b/files/classes/user.py index b8d256564..d455abc92 100644 --- a/files/classes/user.py +++ b/files/classes/user.py @@ -627,11 +627,18 @@ class User(Base): def subscribed_idlist(self, page=1): posts = g.db.query(Subscription.submission_id).filter_by(user_id=self.id).all() return [x[0] for x in posts] + + @property + @lazy + def all_userblocks(self): + ''' User blocks by and targeting this user ''' + return [x[0] for x in g.db.query(UserBlock.target_id).filter(or_(UserBlock.user_id == self.id, UserBlock.target_id == self.id)).all()] @property @lazy def userblocks(self): - return [x[0] for x in g.db.query(UserBlock.target_id).filter_by(user_id=self.id).all()] + [x[0] for x in g.db.query(UserBlock.user_id).filter_by(target_id=self.id).all()] + ''' User blocks by this user ''' + return [x[0] for x in g.db.query(UserBlock.target_id).filter_by(user_id=self.id).all()] @lazy def saved_idlist(self, page=1): diff --git a/files/routes/comments.py b/files/routes/comments.py index d31b04160..89c299558 100644 --- a/files/routes/comments.py +++ b/files/routes/comments.py @@ -216,8 +216,7 @@ def api_comment(v): if existing: abort(409, f"You already made that comment: /comment/{existing.id}") - if parent.author.any_block_exists(v) and v.admin_level < 2: - abort(403, "You can't reply to users who have blocked you, or users you have blocked.") + replying_to_blocked = parent.author.is_blocking(v) and v.admin_level < 2 is_bot = bool(request.headers.get("Authorization")) @@ -297,10 +296,16 @@ def api_comment(v): g.db.commit() if request.headers.get("Authorization"): return c.json - return {"comment": render_template("comments.html", v=v, comments=[c], ajax=True, parent_level=level)} + + if replying_to_blocked: + message = "This user has blocked you. You are still welcome to reply " \ + "but you will be held to a higher standard of civility than you would be otherwise" + else: + message = None + return {"comment": render_template("comments.html", v=v, comments=[c], ajax=True, parent_level=level), "message": message} -def comment_on_publish(comment): +def comment_on_publish(comment:Comment): """ Run when comment becomes visible: immediately for non-filtered comments, or on approval for previously filtered comments. @@ -308,10 +313,11 @@ def comment_on_publish(comment): reflect the comments users will actually see. """ # TODO: Get this out of the routes and into a model eventually... + author = comment.author # Shadowbanned users are invisible. This may lead to inconsistencies if # a user comments while shadowed and is later unshadowed. (TODO?) - if comment.author.shadowbanned: + if author.shadowbanned: return # Comment instances used for purposes other than actual comments (notifs, @@ -329,7 +335,7 @@ def comment_on_publish(comment): to_notify.update([x[0] for x in post_subscribers]) parent = comment.parent - if parent and parent.author_id != comment.author_id: + if parent and parent.author_id != comment.author_id and not parent.author.is_blocking(author): to_notify.add(parent.author_id) for uid in to_notify: diff --git a/files/routes/users.py b/files/routes/users.py index 3e50ebf0a..2ff31ec20 100644 --- a/files/routes/users.py +++ b/files/routes/users.py @@ -772,11 +772,7 @@ def visitors(v): @app.get("/@") @auth_desired def u_username(username, v=None): - - u = get_user(username, v=v) - - if username != u.username: return redirect(SITE_FULL + request.full_path.replace(username, u.username)[:-1]) @@ -803,12 +799,6 @@ def u_username(username, v=None): if request.headers.get("Authorization") or request.headers.get("xhr"): abort(403, f"You are blocking @{u.username}.") return render_template("userpage_blocking.html", u=u, v=v) - - if v and v.admin_level < 2 and hasattr(u, 'is_blocked') and u.is_blocked: - if request.headers.get("Authorization") or request.headers.get("xhr"): abort(403, "This person is blocking you.") - return render_template("userpage_blocked.html", u=u, v=v) - - sort = request.values.get("sort", "new") t = request.values.get("t", "all") try: page = max(int(request.values.get("page", 1)), 1) @@ -858,11 +848,8 @@ def u_username(username, v=None): @app.get("/@/comments") @auth_desired def u_username_comments(username, v=None): - user = get_user(username, v=v) - if username != user.username: return redirect(f'/@{user.username}/comments') - u = user if u.reserved: @@ -880,11 +867,6 @@ def u_username_comments(username, v=None): if request.headers.get("Authorization") or request.headers.get("xhr"): abort(403, f"You are blocking @{u.username}.") return render_template("userpage_blocking.html", u=u, v=v) - if v and v.admin_level < 2 and hasattr(u, 'is_blocked') and u.is_blocked: - if request.headers.get("Authorization") or request.headers.get("xhr"): abort(403, "This person is blocking you.") - return render_template("userpage_blocked.html", u=u, v=v) - - try: page = max(int(request.values.get("page", "1")), 1) except: page = 1 diff --git a/files/templates/settings_blocks.html b/files/templates/settings_blocks.html index 9b8838af1..0d093bd18 100644 --- a/files/templates/settings_blocks.html +++ b/files/templates/settings_blocks.html @@ -1,15 +1,10 @@ {% extends "settings.html" %} - {% block pagetitle %}Block Settings - {{SITE_TITLE}}{% endblock %} - {% block content %} -
-
- {% if error %} {% endif %} -
-
- -
-
-
-

Users you block

-

You have blocked the following users. They cannot reply to your content or notify you with a username mention.

+

You have blocked the following users. They cannot notify you or send you messages and their comments are hidden.

- - {% if v.blocking.first() %}
@@ -61,9 +47,7 @@ @{{block.target.username}} - -
{{block.created_date}}