// HandleUpdate handles the POST of the form to update a page func HandleUpdate(context router.Context) error { // Find the page page, err := pages.Find(context.ParamInt("id")) if err != nil { return router.NotFoundError(err) } // Authorise update page err = authorise.ResourceAndAuthenticity(context, page) if err != nil { return router.NotAuthorizedError(err) } // Update the page from params params, err := context.Params() if err != nil { return router.InternalError(err) } err = page.Update(params.Map()) if err != nil { return router.InternalError(err) } // Redirect to page return router.Redirect(context, page.URLShow()) }
// HandleUpdate handles the POST of the form to update a user func HandleUpdate(context router.Context) error { // Find the user user, err := users.Find(context.ParamInt("id")) if err != nil { return router.NotFoundError(err) } // Authorise update user err = authorise.ResourceAndAuthenticity(context, user) if err != nil { return router.NotAuthorizedError(err) } // Get the params params, err := context.Params() if err != nil { return router.InternalError(err) } // Clean params further for customers, they may only update email, password, key allowedParams := params.Map() u := authorise.CurrentUser(context) if !u.Admin() { // allowedParams = params.Clean(users.AllowedParamsCustomer()) } err = user.Update(allowedParams) if err != nil { return router.InternalError(err) } // Redirect to user return router.Redirect(context, user.URLShow()) }
// HandleIndex displays a list of files func HandleIndex(context router.Context) error { // Authorise err := authorise.Path(context) if err != nil { return router.NotAuthorizedError(err) } // Find the current user and check status u := authorise.CurrentUser(context) if u.Anon() { // return router.NotAuthorizedError(err) } // For admins, show all files, order by date desc q := files.Query().Order("updated_at desc") // otherwise show just the logged in user's files if !u.Admin() { // Find the files for this user, unless q = files.Where("user_id=?", u.Id) } // Fetch the files results, err := files.FindAll(q) if err != nil { return router.InternalError(err) } // Render the template view := view.New(context) view.AddKey("files", results) return view.Render() }
// HandleUpdate or PUT /users/1/update func HandleUpdate(context router.Context) error { // Find the user id := context.ParamInt("id") user, err := users.Find(id) if err != nil { context.Logf("#error Error finding user %s", err) return router.NotFoundError(err) } // Authorise err = authorise.ResourceAndAuthenticity(context, user) if err != nil { return router.NotAuthorizedError(err) } // Get the params params, err := context.Params() if err != nil { return router.InternalError(err) } context.Logf("PARAMS RECD:%v", params) err = user.Update(params.Map()) if err != nil { return router.InternalError(err) } // Redirect to user return router.Redirect(context, user.URLShow()) }
// POST pages/create func HandleCreate(context router.Context) error { // Authorise err := authorise.Path(context) if err != nil { return router.NotAuthorizedError(err) } // Setup context params, err := context.Params() if err != nil { return router.InternalError(err) } id, err := pages.Create(params.Map()) if err != nil { context.Logf("#info Failed to create page %v", params) return router.InternalError(err) } // Log creation context.Logf("#info Created page id,%d", id) // Redirect to the new page p, err := pages.Find(id) if err != nil { context.Logf("#error Error creating page,%s", err) } return router.Redirect(context, p.URLIndex()) }
// HandleUpdate handles POST or PUT /pages/1/update func HandleUpdate(context router.Context) error { // Find the page page, err := pages.Find(context.ParamInt("id")) if err != nil { return router.NotFoundError(err) } // Authorise updating the page err = authorise.Resource(context, page) if err != nil { return router.NotAuthorizedError(err) } // Update the page from params params, err := context.Params() if err != nil { return router.InternalError(err) } err = page.Update(params.Map()) if err != nil { return router.InternalError(err) } // We then find the page again, and retreive the new Url, in case it has changed during update page, err = pages.Find(context.ParamInt("id")) if err != nil { return router.NotFoundError(err) } // Redirect to page url return router.Redirect(context, page.Url) }
// HandleHome serves a get request at / func HandleHome(context router.Context) error { // Setup context for template view := view.New(context) // Authorise err := authorise.Path(context) if err != nil { return router.NotAuthorizedError(err) } // If nothing exists, redirect to set up page if missingUsersAndPages() { return router.Redirect(context, "/fragmenta/setup") } page, err := pages.Find(1) if err != nil { return router.InternalError(err) } view.AddKey("page", page) view.AddKey("meta_title", page.Name) view.AddKey("meta_desc", page.Summary) view.AddKey("meta_keywords", page.Keywords) return view.Render() }
// HandleUpdate handles POST or PUT /images/1/update func HandleUpdate(context router.Context) error { // Find the image image, err := images.Find(context.ParamInt("id")) if err != nil { context.Logf("#error Error finding image %s", err) return router.NotFoundError(err) } // Authorise err = authorise.Resource(context, image) if err != nil { return router.NotAuthorizedError(err) } // Update the image params, err := context.Params() if err != nil { return router.InternalError(err) } err = image.Update(params.Map()) if err != nil { return router.InternalError(err) } // We redirect back to source if redirect param is set return router.Redirect(context, image.URLUpdate()) }
// HandleIndex serves a get request at /pages func HandleIndex(context router.Context) error { // Authorise err := authorise.Path(context) if err != nil { return router.NotAuthorizedError(err) } // Fetch the pages q := pages.Query().Order("url asc") // Filter if necessary filter := context.Param("filter") if len(filter) > 0 { filter = strings.Replace(filter, "&", "", -1) filter = strings.Replace(filter, " ", "", -1) filter = strings.Replace(filter, " ", " & ", -1) q.Where("(to_tsvector(name) || to_tsvector(summary) || to_tsvector(url) @@ to_tsquery(?) )", filter) } pageList, err := pages.FindAll(q) if err != nil { context.Logf("#error Error indexing pages %s", err) return router.InternalError(err) } // Serve template view := view.New(context) view.AddKey("filter", filter) view.AddKey("pages", pageList) return view.Render() }
// HandleCreateShow serves the create form via GET for posts func HandleCreateShow(context router.Context) error { // Authorise err := authorise.Path(context) if err != nil { return router.NotAuthorizedError(err) } // Find users for author details users, err := users.FindAll(users.Admins()) if err != nil { return router.NotFoundError(err) } // Render the template view := view.New(context) post := posts.New() user := authorise.CurrentUser(context) if user != nil { post.AuthorId = user.Id } view.AddKey("post", post) view.AddKey("users", users) return view.Render() }
// POST users/create func HandleCreate(context router.Context) error { // Authorise err := authorise.Path(context) if err != nil { return router.NotAuthorizedError(err) } // Setup context params, err := context.Params() if err != nil { return router.InternalError(err) } // We should check for duplicates in here id, err := users.Create(params.Map()) if err != nil { return router.InternalError(err, "Error", "Sorry, an error occurred creating the user record.") } else { context.Logf("#info Created user id,%d", id) } // Redirect to the new user p, err := users.Find(id) if err != nil { return router.InternalError(err, "Error", "Sorry, an error occurred finding the new user record.") } return router.Redirect(context, p.URLIndex()) }
// HandleUpdateShow handles the POST of the form to update a file func HandleUpdate(context router.Context) error { // Find the file file, err := files.Find(context.ParamInt("id")) if err != nil { return router.NotFoundError(err) } // Authorise update file err = authorise.Resource(context, file) if err != nil { return router.NotAuthorizedError(err) } // Update the file from params params, err := context.Params() if err != nil { return router.InternalError(err) } // Find the to user, by querying users on username or email // Set the user id if found, else return 404 error, user not found // TODO: Make *sure* this only accepts the params we want err = file.Update(params.Map()) if err != nil { return router.InternalError(err) } // Redirect to file return router.Redirect(context, file.URLShow()) }
// HandleUpdate serves POST or PUT /tags/1/update func HandleUpdate(context router.Context) error { // Find the tag tag, err := tags.Find(context.ParamInt("id")) if err != nil { return router.NotFoundError(err) } // Authorise err = authorise.Resource(context, tag) if err != nil { return router.NotAuthorizedError(err) } // Update the tag params, err := context.Params() if err != nil { return router.InternalError(err) } err = tag.Update(params.Map()) if err != nil { return router.InternalError(err) } // Redirect to tag return router.Redirect(context, tag.URLShow()) }
// HandleUpdate handles the POST of the form to update a post func HandleUpdate(context router.Context) error { // Find the post post, err := posts.Find(context.ParamInt("id")) if err != nil { return router.NotFoundError(err) } // Authorise update post err = authorise.Resource(context, post) if err != nil { return router.NotAuthorizedError(err) } // Update the post from params params, err := context.Params() if err != nil { return router.InternalError(err) } err = post.Update(params.Map()) if err != nil { return router.InternalError(err) } // Redirect to post return router.Redirect(context, post.URLShow()) }
// HandleUpdateShow renders the form to update a post func HandleUpdateShow(context router.Context) error { // Find the post post, err := posts.Find(context.ParamInt("id")) if err != nil { return router.NotFoundError(err) } // Authorise update post err = authorise.Resource(context, post) if err != nil { return router.NotAuthorizedError(err) } // Find users for author details users, err := users.FindAll(users.Admins()) if err != nil { return router.NotFoundError(err) } // Render the template view := view.New(context) view.AddKey("post", post) view.AddKey("users", users) return view.Render() }
// HandleDownload sends a single file func HandleDownload(context router.Context) error { // Find the file file, err := files.Find(context.ParamInt("id")) if err != nil { return router.InternalError(err) } // Authorise access to this file - only the file owners can access their own files err = authorise.Resource(context, file) if err != nil { return router.NotAuthorizedError(err) } // If we are permitted, send the file to the user //w.Header().Set("Content-Type", "text/plain; charset=utf-8") //http.DetectContentType(data []byte) string h := context.Header() h.Set("Content-Type", "application/pgp-encrypted") h.Set("Content-Disposition", fmt.Sprintf("attachment; filename=\"%s\"", file.Name())) h.Set("Content-Transfer-Encoding", "binary") http.ServeFile(context, context.Request(), file.Path) return nil }
// HandleUpdate handles the POST of the form to update a story func HandleUpdate(context router.Context) error { // Find the story story, err := stories.Find(context.ParamInt("id")) if err != nil { return router.NotFoundError(err) } // Authorise update story err = authorise.ResourceAndAuthenticity(context, story) if err != nil { return router.NotAuthorizedError(err) } // Update the story from params params, err := context.Params() if err != nil { return router.InternalError(err) } err = story.Update(params.Map()) if err != nil { return err // Create returns a router.Error } err = updateStoriesRank() if err != nil { return router.InternalError(err) } // Redirect to story return router.Redirect(context, story.URLShow()) }
// HandleUpdate responds to POST /comments/update func HandleUpdate(context router.Context) error { // Find the comment comment, err := comments.Find(context.ParamInt("id")) if err != nil { return router.NotFoundError(err) } // Authorise update comment, check auth token err = authorise.ResourceAndAuthenticity(context, comment) if err != nil { return router.NotAuthorizedError(err) } // Update the comment from params params, err := context.Params() if err != nil { return router.InternalError(err) } err = comment.Update(params.Map()) if err != nil { return router.InternalError(err) } // Redirect to comment return router.Redirect(context, comment.URLShow()) }
// HandleShowPath serves requests to a custom page url func HandleShowPath(context router.Context) error { // Setup context for template path := context.Path() q := pages.Query().Where("url=?", path).Limit(1) pages, err := pages.FindAll(q) if err != nil || len(pages) == 0 { return router.NotFoundError(err) } // Get the first of pages to render page := pages[0] // If not published, check authorisation if !page.IsPublished() { // Authorise err = authorise.Resource(context, page) if err != nil { return router.NotAuthorizedError(err) } } return render(context, page) }
// HandleCreate handles the POST of the create form for pages func HandleCreate(context router.Context) error { // Authorise err := authorise.ResourceAndAuthenticity(context, nil) if err != nil { return router.NotAuthorizedError(err) } // Setup context params, err := context.Params() if err != nil { return router.InternalError(err) } id, err := pages.Create(params.Map()) if err != nil { return router.InternalError(err) } // Log creation context.Logf("#info Created page id,%d", id) // Redirect to the new page m, err := pages.Find(id) if err != nil { return router.InternalError(err) } return router.Redirect(context, m.URLIndex()) }
// HandleUpdate responds to POST /comments/update func HandleUpdate(context router.Context) error { // Find the comment comment, err := comments.Find(context.ParamInt("id")) if err != nil { return router.NotFoundError(err) } // Authorise update comment, check auth token err = authorise.ResourceAndAuthenticity(context, comment) if err != nil { return router.NotAuthorizedError(err) } // Update the comment from params params, err := context.Params() if err != nil { return router.InternalError(err) } // Clean params according to role accepted := comments.AllowedParams() if authorise.CurrentUser(context).Admin() { accepted = comments.AllowedParamsAdmin() } cleanedParams := params.Clean(accepted) err = comment.Update(cleanedParams) if err != nil { return router.InternalError(err) } // Redirect to comment return router.Redirect(context, comment.URLShow()) }
// HandleShowPath serves requests to a custom page url func HandleShowPath(context router.Context) error { // Setup context for template path := context.Path() // If no pages or users exist, redirect to set up page if missingUsersAndPages() { return router.Redirect(context, "/fragmenta/setup") } q := pages.Query().Where("url=?", path).Limit(1) pages, err := pages.FindAll(q) if err != nil || len(pages) == 0 { return router.NotFoundError(err) } // Get the first of pages to render page := pages[0] // For show path of pages, we authorise showing the page FOR ALL users if it is published if !page.IsPublished() { // Authorise err = authorise.Resource(context, page) if err != nil { return router.NotAuthorizedError(err) } } return renderPage(context, page) }
// HandleDownvote handles POST to /stories/123/downvote func HandleDownvote(context router.Context) error { // Prevent CSRF err := authorise.AuthenticityToken(context) if err != nil { return router.NotAuthorizedError(err, "Vote Failed", "CSRF failure") } // Find the story story, err := stories.Find(context.ParamInt("id")) if err != nil { return router.NotFoundError(err) } user := authorise.CurrentUser(context) ip := getUserIP(context) if !user.Admin() { // Check we have no votes already from this user, if we do fail if storyHasUserVote(story, user) { return router.NotAuthorizedError(err, "Vote Failed", "Sorry you are not allowed to vote twice, nice try!") } } // Authorise upvote on story for this user - our rules are: if !user.CanDownvote() { return router.NotAuthorizedError(err, "Vote Failed", "Sorry, you can't downvote yet") } err = authorise.Resource(context, story) if err != nil { return router.NotAuthorizedError(err, "Vote Failed", "Sorry you are not allowed to vote") } err = adjustUserPoints(user, -1) if err != nil { return err } // Adjust points on story and add to the vote table err = addStoryVote(story, user, ip, -1) if err != nil { return err } return updateStoriesRank() }
// Serve a get request at /images // // func HandleIndex(context router.Context) error { // Authorise err := authorise.Path(context) if err != nil { return router.NotAuthorizedError(err) } // Setup context for template view := view.New(context) // Build a query q := images.Query() // Show only published (defaults to showing all) // q.Apply(status.WherePublished) // Order by required order, or default to id asc switch context.Param("order") { case "1": q.Order("created_at desc") case "2": q.Order("updated_at desc") case "3": q.Order("name asc") default: q.Order("id desc") } // Filter if necessary - this assumes name and summary cols filter := context.Param("filter") if len(filter) > 0 { filter = strings.Replace(filter, "&", "", -1) filter = strings.Replace(filter, " ", "", -1) filter = strings.Replace(filter, " ", " & ", -1) q.Where("( to_tsvector(name) || to_tsvector(summary) @@ to_tsquery(?) )", filter) } // Fetch the images imagesList, err := images.FindAll(q) if err != nil { return router.InternalError(err) } // Serve template view.AddKey("filter", filter) view.AddKey("images", imagesList) // Can we add these programatically? view.AddKey("admin_links", helpers.Link("Create image", images.New().URLCreate())) return view.Render() }
// HandleDownvote handles POST to /comments/123/downvote func HandleDownvote(context router.Context) error { // Prevent CSRF err := authorise.AuthenticityToken(context) if err != nil { return router.NotAuthorizedError(err, "Vote Failed", "CSRF failure") } // Find the comment comment, err := comments.Find(context.ParamInt("id")) if err != nil { return router.NotFoundError(err) } user := authorise.CurrentUser(context) ip := getUserIP(context) if !user.Admin() { // Check we have no votes already from this user, if we do fail if commentHasUserVote(comment, user) { return router.NotAuthorizedError(err, "Vote Failed", "Sorry you are not allowed to vote twice, nice try!") } } // Authorise upvote on comment for this user - our rules are: if !user.CanDownvote() { return router.NotAuthorizedError(err, "Vote Failed", "Sorry, you can't downvote yet") } // CURRENT User burns points for downvoting err = adjustUserPoints(user, -1) if err != nil { return err } // Adjust points on comment and add to the vote table err = addCommentVote(comment, user, ip, -1) if err != nil { return err } return updateCommentsRank(comment.StoryId) }
// HandleFlag handles POST to /stories/123/flag func HandleFlag(context router.Context) error { // Protect against CSRF err := authorise.AuthenticityToken(context) if err != nil { return router.NotAuthorizedError(err, "Flag Failed", "CSRF failure") } // Find the story story, err := stories.Find(context.ParamInt("id")) if err != nil { return router.NotFoundError(err) } user := authorise.CurrentUser(context) ip := getUserIP(context) // Check we have no votes already from this user, if we do fail if storyHasUserFlag(story, user) { return router.NotAuthorizedError(err, "Flag Failed", "Sorry you are not allowed to flag twice, nice try!") } // Authorise upvote on story for this user if !user.CanFlag() { return router.NotAuthorizedError(err, "Flag Failed", "Sorry, you can't flag yet") } err = authorise.Resource(context, story) if err != nil { return router.NotAuthorizedError(err, "Flag Failed", "Sorry you are not allowed to flag") } err = adjustUserPoints(user, -1) if err != nil { return err } err = addStoryVote(story, user, ip, -5) if err != nil { return err } return updateStoriesRank() }
// HandleUpdate or PUT /users/1/update func HandleUpdate(context router.Context) error { // Find the user id := context.ParamInt("id") user, err := users.Find(id) if err != nil { context.Logf("#error Error finding user %s", err) return router.NotFoundError(err) } // Authorise err = authorise.Resource(context, user) if err != nil { return router.NotAuthorizedError(err) } // We expect only one image, what about replacing the existing when updating? // At present we just create a new image files, err := context.ParamFiles("image") if err != nil { return router.InternalError(err) } // Get the params params, err := context.Params() if err != nil { return router.InternalError(err) } var imageID int64 if len(files) > 0 { fileHandle := files[0] // Create an image (saving the image representation on disk) imageParams := map[string]string{"name": user.Name, "status": "100"} imageID, err = images.Create(imageParams, fileHandle) if err != nil { return router.InternalError(err) } params.Set("image_id", fmt.Sprintf("%d", imageID)) delete(params, "image") } err = user.Update(params.Map()) if err != nil { return router.InternalError(err) } // Redirect to user return router.Redirect(context, user.URLShow()) }
// HandleShowSetup shows the setup page at /fragmenta/setup func HandleShowSetup(context router.Context) error { // Setup context for template view := view.New(context) // If we have pages or users already, do not proceed if !missingUsersAndPages() { return router.NotAuthorizedError(nil) } view.Template("pages/views/setup.html.got") return view.Render() }
// HandleCreateShow serves GET images/create func HandleCreateShow(context router.Context) error { // Authorise err := authorise.Path(context) if err != nil { return router.NotAuthorizedError(err) } // Serve the template view := view.New(context) image := images.New() view.AddKey("image", image) return view.Render() }
// HandleIndex displays a list of posts func HandleIndex(context router.Context) error { // Authorise err := authorise.Path(context) if err != nil { return router.NotAuthorizedError(err) } // Build a query q := posts.Query() // Order by required order, or default to id asc switch context.Param("order") { case "1": q.Order("created desc") case "2": q.Order("updated desc") case "3": q.Order("name asc") default: q.Order("id asc") } // Filter if necessary - this assumes name and summary cols filter := context.Param("filter") if len(filter) > 0 { filter = strings.Replace(filter, "&", "", -1) filter = strings.Replace(filter, " ", "", -1) filter = strings.Replace(filter, " ", " & ", -1) q.Where("( to_tsvector(name) || to_tsvector(summary) @@ to_tsquery(?) )", filter) } // Fetch the posts results, err := posts.FindAll(q) if err != nil { return router.InternalError(err) } // Render the template view := view.New(context) view.AddKey("filter", filter) view.AddKey("posts", results) return view.Render() }