external-repos/ivatar
1
0
Fork 0
mirror of https://git.linux-kernel.at/oliver/ivatar.git synced 2025-11-14 12:08:04 +00:00
Code Issues Packages Projects Releases Wiki Activity

Allow staff (is_staff) to view other peoples raw images as well as their profile, by appending the username to the profile url - for support reasons

Browse Source
This commit is contained in:
Oliver Falk
2019-08-02 11:55:02 +02:00
parent 5486fe2c64
commit 94c3ab1e41
2 changed files with 11 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
ivatar/ivataraccount/urls.py
View File

@@ -63,6 +63,7 @@ urlpatterns = [ # pylint: disable=invalid-name
), name='export'), ), name='export'),
path('delete/', DeleteAccountView.as_view(), name='delete'), path('delete/', DeleteAccountView.as_view(), name='delete'),
path('profile/', ProfileView.as_view(), name='profile'), path('profile/', ProfileView.as_view(), name='profile'),
url('profile/(?P<profile_username>\w+)', ProfileView.as_view(), name='profile_with_profile_username'),
path('add_email/', AddEmailView.as_view(), name='add_email'), path('add_email/', AddEmailView.as_view(), name='add_email'),
path('add_openid/', AddOpenIDView.as_view(), name='add_openid'), path('add_openid/', AddOpenIDView.as_view(), name='add_openid'),
path('upload_photo/', UploadPhotoView.as_view(), name='upload_photo'), path('upload_photo/', UploadPhotoView.as_view(), name='upload_photo'),

11
ivatar/ivataraccount/views.py
View File

@@ -409,7 +409,7 @@ class RawImageView(DetailView):
def get(self, request, *args, **kwargs): def get(self, request, *args, **kwargs):
photo = self.model.objects.get(pk=kwargs['pk']) # pylint: disable=no-member photo = self.model.objects.get(pk=kwargs['pk']) # pylint: disable=no-member
if not photo.user.id == request.user.id: if not photo.user.id == request.user.id and not request.user.is_staff:
return HttpResponseRedirect(reverse_lazy('home')) return HttpResponseRedirect(reverse_lazy('home'))
return HttpResponse( return HttpResponse(
BytesIO(photo.data), content_type='image/%s' % photo.format) BytesIO(photo.data), content_type='image/%s' % photo.format)
@@ -883,6 +883,15 @@ class ProfileView(TemplateView):
template_name = 'profile.html' template_name = 'profile.html'
def get(self, request, *args, **kwargs): def get(self, request, *args, **kwargs):
if 'profile_username' in kwargs:
if not request.user.is_staff:
return HttpResponseRedirect(reverse_lazy('profile'))
try:
u = User.objects.get(username=kwargs['profile_username'])
request.user = u
except:
pass
self._confirm_claimed_openid() self._confirm_claimed_openid()
return super().get(self, request, args, kwargs) return super().get(self, request, args, kwargs)