comparison forums/forms.py @ 963:4619290d171d

Whitelist hot-linked image sources.
author Brian Neal <bgneal@gmail.com>
date Tue, 01 Sep 2015 20:33:40 -0500
parents 5366c29d6dce
children 21c592cac71c
comparison
equal deleted inserted replaced
962:10e7570a3aab 963:4619290d171d
11 from forums.models import Topic 11 from forums.models import Topic
12 from forums.models import Post 12 from forums.models import Post
13 from forums.attachments import AttachmentProcessor 13 from forums.attachments import AttachmentProcessor
14 import forums.permissions as perms 14 import forums.permissions as perms
15 from forums.signals import notify_new_topic, notify_new_post 15 from forums.signals import notify_new_topic, notify_new_post
16 from core.html import ImageCheckError
17 from core.html import image_check
18 from core.markup import site_markup
16 19
17 20
18 FORUMS_FORM_CSS = { 21 FORUMS_FORM_CSS = {
19 'all': (settings.GPP_THIRD_PARTY_CSS['markitup'] + 22 'all': (settings.GPP_THIRD_PARTY_CSS['markitup'] +
20 settings.GPP_THIRD_PARTY_CSS['jquery-ui']) 23 settings.GPP_THIRD_PARTY_CSS['jquery-ui'])
42 super(NewPostForm, self).__init__(*args, **kwargs) 45 super(NewPostForm, self).__init__(*args, **kwargs)
43 attachments = args[0].getlist('attachment') if len(args) else [] 46 attachments = args[0].getlist('attachment') if len(args) else []
44 self.attach_proc = AttachmentProcessor(attachments) 47 self.attach_proc = AttachmentProcessor(attachments)
45 48
46 def clean_body(self): 49 def clean_body(self):
47 data = self.cleaned_data['body'] 50 body = self.cleaned_data['body']
48 if not data and not self.attach_proc.has_attachments(): 51 self.body_html = None
49 raise forms.ValidationError("This field is required.") 52 if not body and not self.attach_proc.has_attachments():
50 return data 53 raise forms.ValidationError("Please enter some text")
54
55 if body:
56 self.body_html = site_markup(body)
57 try:
58 image_check(self.body_html)
59 except ImageCheckError as ex:
60 raise forms.ValidationError(str(ex))
61
62 return body
51 63
52 def clean_topic_id(self): 64 def clean_topic_id(self):
53 id = self.cleaned_data['topic_id'] 65 id = self.cleaned_data['topic_id']
54 try: 66 try:
55 self.topic = Topic.objects.select_related().get(pk=id) 67 self.topic = Topic.objects.select_related().get(pk=id)
56 except Topic.DoesNotExist: 68 except Topic.DoesNotExist:
57 raise forms.ValidationError('invalid topic') 69 raise forms.ValidationError('Invalid topic')
58 return id 70 return id
59 71
60 def save(self, user, ip=None): 72 def save(self, user, ip=None):
61 """ 73 """
62 Creates a new post from the form data and supplied arguments. 74 Creates a new post from the form data and supplied arguments.
63 """ 75 """
64 post = Post(topic=self.topic, user=user, body=self.cleaned_data['body'], 76 post = Post(topic=self.topic, user=user, body=self.cleaned_data['body'],
65 user_ip=ip) 77 user_ip=ip)
66 post.save() 78 post.save(html=self.body_html)
67 self.attach_proc.save_attachments(post) 79 self.attach_proc.save_attachments(post)
68 notify_new_post(post) 80 notify_new_post(post)
69 return post 81 return post
70 82
71 83
110 self.fields['attachment'] = forms.MultipleChoiceField(label='', 122 self.fields['attachment'] = forms.MultipleChoiceField(label='',
111 widget=forms.MultipleHiddenInput(), 123 widget=forms.MultipleHiddenInput(),
112 choices=[(v, v) for v in pks]) 124 choices=[(v, v) for v in pks])
113 125
114 def clean_body(self): 126 def clean_body(self):
115 data = self.cleaned_data['body'] 127 body = self.cleaned_data['body']
116 if not data and not self.attach_proc.has_attachments(): 128 self.body_html = None
129 if not body and not self.attach_proc.has_attachments():
117 raise forms.ValidationError("This field is required.") 130 raise forms.ValidationError("This field is required.")
118 return data 131
132 if body:
133 self.body_html = site_markup(body)
134 try:
135 image_check(self.body_html)
136 except ImageCheckError as ex:
137 raise forms.ValidationError(str(ex))
138
139 return body
119 140
120 def save(self, ip=None): 141 def save(self, ip=None):
121 """ 142 """
122 Creates the new Topic and first Post from the form data and supplied 143 Creates the new Topic and first Post from the form data and supplied
123 arguments. 144 arguments.
131 152
132 post = Post(topic=topic, 153 post = Post(topic=topic,
133 user=self.user, 154 user=self.user,
134 body=self.cleaned_data['body'], 155 body=self.cleaned_data['body'],
135 user_ip=ip) 156 user_ip=ip)
136 post.save() 157 post.save(html=self.body_html)
137 158
138 self.attach_proc.save_attachments(post) 159 self.attach_proc.save_attachments(post)
139 160
140 notify_new_topic(topic) 161 notify_new_topic(topic)
141 notify_new_post(post) 162 notify_new_post(post)
187 if post.attachments.count(): 208 if post.attachments.count():
188 self.fields['post_id'] = forms.CharField(label='', 209 self.fields['post_id'] = forms.CharField(label='',
189 widget=forms.HiddenInput(attrs={'value': post.id})) 210 widget=forms.HiddenInput(attrs={'value': post.id}))
190 211
191 def clean_body(self): 212 def clean_body(self):
192 data = self.cleaned_data['body'] 213 body = self.cleaned_data['body']
193 if not data and not self.attach_proc.has_attachments(): 214 self.body_html = None
215 if not body and not self.attach_proc.has_attachments():
194 raise forms.ValidationError('This field is required.') 216 raise forms.ValidationError('This field is required.')
195 return data 217
218 if body:
219 self.body_html = site_markup(body)
220 try:
221 image_check(self.body_html)
222 except ImageCheckError as ex:
223 raise forms.ValidationError(str(ex))
224
225 return body
196 226
197 def save(self, *args, **kwargs): 227 def save(self, *args, **kwargs):
198 commit = kwargs.get('commit', False) 228 commit = kwargs.get('commit', False)
199 post = super(PostForm, self).save(*args, **kwargs) 229 post = super(PostForm, self).save(*args, **kwargs)
200 230