/download')
-@login_required
def download_job_result(job_id, job_result_id):
- job_result = JobResult.query.get_or_404(job_result_id)
- if job_result.job.id != job_id:
- abort(404)
+ job_result = JobResult.query.filter_by(job_id=job_id, id=job_result_id).first_or_404()
if not (job_result.job.user == current_user or current_user.is_administrator()):
abort(403)
return send_from_directory(
diff --git a/app/main/routes.py b/app/main/routes.py
index f5fac68d..cda06da6 100644
--- a/app/main/routes.py
+++ b/app/main/routes.py
@@ -79,6 +79,7 @@ def terms_of_use():
@bp.route('/social-area')
@register_breadcrumb(bp, '.social_area', 'groupSocial Area')
+@login_required
def social_area():
# corpora = [
# c.to_json_serializeable() for c
diff --git a/app/models.py b/app/models.py
index bcc030e5..57658074 100644
--- a/app/models.py
+++ b/app/models.py
@@ -693,7 +693,7 @@ class User(HashidMixin, UserMixin, db.Model):
db.session.commit()
def can(self, permission):
- return self.role.has_permission(permission)
+ return self.role is not None and self.role.has_permission(permission)
def confirm(self, confirmation_token):
try:
diff --git a/app/services/__init__.py b/app/services/__init__.py
index 73c78b59..ba1eb297 100644
--- a/app/services/__init__.py
+++ b/app/services/__init__.py
@@ -9,4 +9,16 @@ with open(services_file, 'r') as f:
SERVICES = yaml.safe_load(f)
bp = Blueprint('services', __name__)
+
+
+@bp.before_request
+@login_required
+def before_request():
+ '''
+ Ensures that the routes in this package can only be visited by users that
+ are logged in.
+ '''
+ pass
+
+
from . import routes # noqa
diff --git a/app/services/routes.py b/app/services/routes.py
index 7ab36384..0a8c2811 100644
--- a/app/services/routes.py
+++ b/app/services/routes.py
@@ -1,6 +1,6 @@
from flask import abort, current_app, flash, Markup, redirect, render_template, request, url_for
from flask_breadcrumbs import register_breadcrumb
-from flask_login import current_user, login_required
+from flask_login import current_user
import requests
from app import db, hashids
from app.models import (
@@ -21,14 +21,12 @@ from .forms import (
@bp.route('/services')
@register_breadcrumb(bp, '.', 'Services')
-@login_required
def services():
return redirect(url_for('main.dashboard'))
@bp.route('/file-setup-pipeline', methods=['GET', 'POST'])
@register_breadcrumb(bp, '.file_setup_pipeline', 'File Setup')
-@login_required
def file_setup_pipeline():
service = 'file-setup-pipeline'
service_manifest = SERVICES[service]
@@ -70,7 +68,6 @@ def file_setup_pipeline():
@bp.route('/tesseract-ocr-pipeline', methods=['GET', 'POST'])
@register_breadcrumb(bp, '.tesseract_ocr_pipeline', 'Tesseract OCR Pipeline')
-@login_required
def tesseract_ocr_pipeline():
service_name = 'tesseract-ocr-pipeline'
service_manifest = SERVICES[service_name]
@@ -120,7 +117,6 @@ def tesseract_ocr_pipeline():
@bp.route('/transkribus-htr-pipeline', methods=['GET', 'POST'])
@register_breadcrumb(bp, '.transkribus_htr_pipeline', 'Transkribus HTR Pipeline')
-@login_required
def transkribus_htr_pipeline():
if not current_app.config.get('NOPAQUE_TRANSKRIBUS_ENABLED'):
abort(404)
@@ -179,7 +175,6 @@ def transkribus_htr_pipeline():
@bp.route('/spacy-nlp-pipeline', methods=['GET', 'POST'])
@register_breadcrumb(bp, '.spacy_nlp_pipeline', 'SpaCy NLP Pipeline')
-@login_required
def spacy_nlp_pipeline():
service = 'spacy-nlp-pipeline'
service_manifest = SERVICES[service]
@@ -225,7 +220,6 @@ def spacy_nlp_pipeline():
@bp.route('/corpus-analysis')
@register_breadcrumb(bp, '.corpus_analysis', 'Corpus Analysis')
-@login_required
def corpus_analysis():
return render_template(
'services/corpus_analysis.html.j2',
diff --git a/app/settings/__init__.py b/app/settings/__init__.py
index 56265277..0f3d7815 100644
--- a/app/settings/__init__.py
+++ b/app/settings/__init__.py
@@ -2,4 +2,16 @@ from flask import Blueprint
bp = Blueprint('settings', __name__)
+
+
+@bp.before_request
+@login_required
+def before_request():
+ '''
+ Ensures that the routes in this package can only be visited by users that
+ are logged in.
+ '''
+ pass
+
+
from . import routes
diff --git a/app/templates/admin/user.html.j2 b/app/templates/admin/user.html.j2
index 73be0732..82c8723d 100644
--- a/app/templates/admin/user.html.j2
+++ b/app/templates/admin/user.html.j2
@@ -17,7 +17,9 @@
unconfirmed
{% endif %}
- {{ user.about_me if user.about_me }}
+ {% if user.about_me %}
+ {{ user.about_me }}
+ {% endif %}
diff --git a/app/users/__init__.py b/app/users/__init__.py
index a1ed4f2e..46227fca 100644
--- a/app/users/__init__.py
+++ b/app/users/__init__.py
@@ -2,5 +2,17 @@ from flask import Blueprint
bp = Blueprint('users', __name__)
+
+
+@bp.before_request
+@login_required
+def before_request():
+ '''
+ Ensures that the routes in this package can only be visited by users that
+ are logged in.
+ '''
+ pass
+
+
from . import events, json_routes, routes
from . import settings
diff --git a/app/users/json_routes.py b/app/users/json_routes.py
index 571fa78c..b9cbb3e3 100644
--- a/app/users/json_routes.py
+++ b/app/users/json_routes.py
@@ -1,5 +1,5 @@
from flask import abort, current_app
-from flask_login import current_user, login_required, logout_user
+from flask_login import current_user, logout_user
from threading import Thread
from app import db
from app.decorators import content_negotiation
@@ -8,7 +8,6 @@ from . import bp
@bp.route('/', methods=['DELETE'])
-@login_required
@content_negotiation(produces='application/json')
def delete_user(user_id):
def _delete_user(app, user_id):
diff --git a/app/users/routes.py b/app/users/routes.py
index 7b86a8e1..fbb5a609 100644
--- a/app/users/routes.py
+++ b/app/users/routes.py
@@ -6,23 +6,21 @@ from flask import (
url_for
)
from flask_breadcrumbs import register_breadcrumb
-from flask_login import current_user, login_required
+from flask_login import current_user
import os
-from app.models import Corpus, User
+from app.models import User
from . import bp
from .utils import user_dynamic_list_constructor as user_dlc
@bp.route('')
@register_breadcrumb(bp, '.', 'groupUsers')
-@login_required
def users():
return redirect(url_for('main.social_area', _anchor='users'))
@bp.route('/')
@register_breadcrumb(bp, '.entity', '', dynamic_list_constructor=user_dlc)
-@login_required
def user(user_id):
user = User.query.get_or_404(user_id)
if not (user.is_public or user == current_user or current_user.is_administrator()):
@@ -35,7 +33,6 @@ def user(user_id):
@bp.route('//avatar')
-@login_required
def user_avatar(user_id):
user = User.query.get_or_404(user_id)
if not (user.is_public or user == current_user or current_user.is_administrator()):
diff --git a/app/users/settings/json_routes.py b/app/users/settings/json_routes.py
index 1d0c4d9e..03f34a22 100644
--- a/app/users/settings/json_routes.py
+++ b/app/users/settings/json_routes.py
@@ -1,5 +1,5 @@
from flask import abort, request
-from flask_login import current_user, login_required
+from flask_login import current_user
from app import db
from app.decorators import content_negotiation
from app.models import User, ProfilePrivacySettings
@@ -7,7 +7,6 @@ from . import bp
@bp.route('//settings/profile-privacy/is-public', methods=['PUT'])
-@login_required
@content_negotiation(consumes='application/json', produces='application/json')
def update_user_profile_privacy_setting_is_public(user_id):
user = User.query.get_or_404(user_id)
@@ -26,7 +25,6 @@ def update_user_profile_privacy_setting_is_public(user_id):
@bp.route('//settings/profile-privacy/', methods=['PUT'])
-@login_required
@content_negotiation(consumes='application/json', produces='application/json')
def update_user_profile_privacy_settings(user_id, profile_privacy_setting_name):
user = User.query.get_or_404(user_id)
diff --git a/app/users/settings/routes.py b/app/users/settings/routes.py
index d921c5c4..68f0a303 100644
--- a/app/users/settings/routes.py
+++ b/app/users/settings/routes.py
@@ -1,6 +1,6 @@
from flask import abort, flash, g, redirect, render_template, url_for
from flask_breadcrumbs import register_breadcrumb
-from flask_login import current_user, login_required
+from flask_login import current_user
from app import db
from app.models import Avatar, User
from ..utils import user_endpoint_arguments_constructor as user_eac
@@ -16,7 +16,6 @@ from .forms import (
@bp.route('//settings', methods=['GET', 'POST'])
@register_breadcrumb(bp, '.entity.settings', 'settingsSettings', endpoint_arguments_constructor=user_eac)
-@login_required
def settings(user_id):
user = User.query.get_or_404(user_id)
if not (user == current_user or current_user.is_administrator()):