From 5d0e4a520e1cf92c3046a0f437694ed1c7bda08b Mon Sep 17 00:00:00 2001 From: Christoph Haas Date: Wed, 10 Mar 2021 01:04:28 +0100 Subject: [PATCH] Allow hiding and un-hiding of screenshot by moderators --- app/controllers/packages_controller.rb | 34 +++++++++++++++++++ app/models/ability.rb | 16 ++++----- app/models/screenshot.rb | 12 ++++++- config/routes.rb | 2 ++ ...9233239_add_hidden_field_to_screenshots.rb | 5 +++ db/schema.rb | 3 +- 6 files changed, 62 insertions(+), 10 deletions(-) create mode 100644 db/migrate/20210309233239_add_hidden_field_to_screenshots.rb diff --git a/app/controllers/packages_controller.rb b/app/controllers/packages_controller.rb index 8d04530..dac2927 100644 --- a/app/controllers/packages_controller.rb +++ b/app/controllers/packages_controller.rb @@ -176,6 +176,40 @@ class PackagesController < ApplicationController end end + def hide_screenshot + # Is the user allowed to hide this screenshot? + @screenshot = Screenshot.find(params[:id]) + + # Check if the user is allowed to change this screenshot + # - Is this the user's own screenshot? (anonymous) + if can? :hide, @screenshot + auditlog "Screenshot #{@screenshot.id} hidden", + package: @screenshot.package + @screenshot.hide! + flash['notice'] = "Screenshot hidden." + redirect_back(fallback_location: package_path(name: @screenshot.package.name)) + else + head :forbidden + end + end + + def unhide_screenshot + # Is the user allowed to unhide this screenshot? + @screenshot = Screenshot.find(params[:id]) + + # Check if the user is allowed to change this screenshot + # - Is this the user's own screenshot? (anonymous) + if can? :unhide, @screenshot + auditlog "Screenshot #{@screenshot.id} un-hidden", + package: @screenshot.package + @screenshot.unhide! + flash['notice'] = "Screenshot un-hidden." + redirect_back(fallback_location: package_path(name: @screenshot.package.name)) + else + head :forbidden + end + end + def delete_screenshot # Is the user allowed to delete the screenshot? @screenshot = Screenshot.find(params[:id]) diff --git a/app/models/ability.rb b/app/models/ability.rb index 6e4587c..e933177 100644 --- a/app/models/ability.rb +++ b/app/models/ability.rb @@ -32,18 +32,19 @@ class Ability # See the wiki for details: # https://github.com/CanCanCommunity/cancancan/wiki/Defining-Abilities + # Everybody can see public screenshots + can :view, Screenshot, approved: true, hidden:false + if user.present? # Logged-in users - # Allow to view all public/approved screenshots - can :view, Screenshot, approved: true - # Allow to view any own uploads (even not-yet-approved) + # Allow to view own uploads (even not-yet-approved) can :view, Screenshot, user_id: user.id can :destroy, Screenshot, user_id: user.id if user.admin_role? can :approve, Screenshot can :destroy, Screenshot - can :hide, Screenshot - can :unhide, Screenshot + can :hide, Screenshot, hidden: false + can :unhide, Screenshot, hidden: true can :destroy, User can :view, Screenshot can :destroy, Package @@ -51,11 +52,10 @@ class Ability end if user.moderator_role? can :approve, Screenshot - can :hide, Screenshot + can :hide, Screenshot, hidden: false + can :unhide, Screenshot, hidden: true can :view, Screenshot end - else # Nobody logged in - can :view, Screenshot, approved: true end end end diff --git a/app/models/screenshot.rb b/app/models/screenshot.rb index 0a3d5c3..b9d9957 100644 --- a/app/models/screenshot.rb +++ b/app/models/screenshot.rb @@ -5,7 +5,7 @@ class Screenshot < ApplicationRecord # Default sorting: # - unapproved first (to see them at the top when moderating) # - otherwise show newest first - default_scope { order(approved: :asc, created_at: :desc) } + default_scope { order(approved: :asc, hidden: :asc, created_at: :desc) } # Shrine include ImageUploader::Attachment(:simage) # adds an `simage` virtual attribute @@ -63,6 +63,16 @@ class Screenshot < ApplicationRecord self.save! end + # Hide a screenshot from the public. Moderator level can do this. + def hide! + self.hidden = true + self.save! + end + def unhide! + self.hidden = false + self.save! + end + # Get the newest screenshots regardless of the package it belongs to def self.newest self.order(created_at: :desc) diff --git a/config/routes.rb b/config/routes.rb index 5271c93..c75403d 100644 --- a/config/routes.rb +++ b/config/routes.rb @@ -36,6 +36,8 @@ Rails.application.routes.draw do post 'upload/:name/json' => 'packages#upload_receive', as: :upload_receive_json, name: /[^\/]+/, returns: :json # TODO: "get" is probably the wrong method to delete a screenshot get 'delete_screenshot/:id' => 'packages#delete_screenshot', as: :delete_screenshot + get 'hide_screenshot/:id' => 'packages#hide_screenshot', as: :hide_screenshot + get 'unhide_screenshot/:id' => 'packages#unhide_screenshot', as: :unhide_screenshot patch 'update_screenshot_description/:id' => 'packages#update_screenshot_description', as: :update_screenshot_description #post 'report_screenshot/:id' => 'packages#report_screenshot', as: :report_screenshot # TODO: "get" is probably the wrong method to delete a screenshot diff --git a/db/migrate/20210309233239_add_hidden_field_to_screenshots.rb b/db/migrate/20210309233239_add_hidden_field_to_screenshots.rb new file mode 100644 index 0000000..62a9e1e --- /dev/null +++ b/db/migrate/20210309233239_add_hidden_field_to_screenshots.rb @@ -0,0 +1,5 @@ +class AddHiddenFieldToScreenshots < ActiveRecord::Migration[6.1] + def change + add_column :screenshots, :hidden, :boolean, default: false + end +end diff --git a/db/schema.rb b/db/schema.rb index 6ee9265..6688f86 100644 --- a/db/schema.rb +++ b/db/schema.rb @@ -10,7 +10,7 @@ # # It's strongly recommended that you check this file into your version control system. -ActiveRecord::Schema.define(version: 2021_03_03_213303) do +ActiveRecord::Schema.define(version: 2021_03_09_233239) do # These are extensions that must be enabled in order to support this database enable_extension "plpgsql" @@ -96,6 +96,7 @@ ActiveRecord::Schema.define(version: 2021_03_03_213303) do t.integer "user_id", default: 0 t.text "simage_data" t.inet "uploaderip" + t.boolean "hidden", default: false t.index ["id", "approved"], name: "id_approved" t.index ["id", "uploaderhash"], name: "id_uploaderhash" end