From a4c7dd7912c2ee63eaaee3819d2651bdf3d1d644 Mon Sep 17 00:00:00 2001 From: nyaadev Date: Thu, 18 May 2017 15:09:35 +0200 Subject: [PATCH] Add ReCaptcha to upload page if user is not logged in. Bring back CSRF to upload form (Use the upload API) --- nyaa/forms.py | 16 +++++++++++---- nyaa/routes.py | 10 +++++----- nyaa/templates/upload.html | 41 ++++++++++++++++++++++++++------------ 3 files changed, 45 insertions(+), 22 deletions(-) diff --git a/nyaa/forms.py b/nyaa/forms.py index 783e428..1a61706 100644 --- a/nyaa/forms.py +++ b/nyaa/forms.py @@ -1,3 +1,4 @@ +import flask from nyaa import db, app from nyaa.models import User from nyaa import bencode, utils, models @@ -15,6 +16,7 @@ from wtforms.widgets import Select as SelectWidget from wtforms.widgets import html_params, HTMLString from flask_wtf.recaptcha import RecaptchaField +from flask_wtf.recaptcha.validators import Recaptcha as RecaptchaValidator class Unique(object): @@ -164,10 +166,6 @@ class EditForm(FlaskForm): class UploadForm(FlaskForm): - - class Meta: - csrf = False - torrent_file = FileField('Torrent file', [ FileRequired() ]) @@ -179,6 +177,16 @@ class UploadForm(FlaskForm): '%(max)d at most.') ]) + if app.config['USE_RECAPTCHA']: + # Captcha only for not logged in users + _recaptcha_validator = RecaptchaValidator() + + def _validate_recaptcha(form, field): + if not flask.g.user: + return UploadForm._recaptcha_validator(form, field) + + recaptcha = RecaptchaField(validators=[_validate_recaptcha]) + # category = SelectField('Category') category = DisabledSelectField('Category') diff --git a/nyaa/routes.py b/nyaa/routes.py index a9652d5..7dda5e5 100644 --- a/nyaa/routes.py +++ b/nyaa/routes.py @@ -558,17 +558,17 @@ def _create_upload_category_choices(): @app.route('/upload', methods=['GET', 'POST']) def upload(): - form = forms.UploadForm(CombinedMultiDict((flask.request.files, flask.request.form))) - form.category.choices = _create_upload_category_choices() + upload_form = forms.UploadForm(CombinedMultiDict((flask.request.files, flask.request.form))) + upload_form.category.choices = _create_upload_category_choices() - if flask.request.method == 'POST' and form.validate(): - torrent = backend.handle_torrent_upload(form, flask.g.user) + if flask.request.method == 'POST' and upload_form.validate(): + torrent = backend.handle_torrent_upload(upload_form, flask.g.user) return flask.redirect('/view/' + str(torrent.id)) else: # If we get here with a POST, it means the form data was invalid: return a non-okay status status_code = 400 if flask.request.method == 'POST' else 200 - return flask.render_template('upload.html', form=form, user=flask.g.user), status_code + return flask.render_template('upload.html', upload_form=upload_form), status_code @app.route('/view/') diff --git a/nyaa/templates/upload.html b/nyaa/templates/upload.html index 778a37d..e54beaa 100644 --- a/nyaa/templates/upload.html +++ b/nyaa/templates/upload.html @@ -7,25 +7,27 @@

Upload Torrent

-{% if not user %} +{% if not g.user %}

You are not logged in, and are uploading anonymously.

{% endif %}
Drop here!
- {% if config.ENFORCE_MAIN_ANNOUNCE_URL %}

Important: Please include {{config.MAIN_ANNOUNCE_URL}} in your trackers

{% endif %} + {{ upload_form.csrf_token }} + + {% if config.ENFORCE_MAIN_ANNOUNCE_URL %}

Important: Please include {{ config.MAIN_ANNOUNCE_URL }} in your trackers

{% endif %}
- {{ render_upload(form.torrent_file, accept=".torrent") }} + {{ render_upload(upload_form.torrent_file, accept=".torrent") }}
- {{ render_field(form.display_name, class_='form-control', placeholder='Display name') }} + {{ render_field(upload_form.display_name, class_='form-control', placeholder='Display name') }}
- {{ render_field(form.category, class_='form-control')}} + {{ render_field(upload_form.category, class_='form-control')}}
@@ -33,30 +35,30 @@
- {{ render_field(form.information, class_='form-control', placeholder='Your website or IRC channel') }} + {{ render_field(upload_form.information, class_='form-control', placeholder='Your website or IRC channel') }}
- {% if user.is_trusted %} + {% if g.user.is_trusted %} {% endif %} @@ -66,10 +68,23 @@
- {{ render_markdown_editor(form.description, field_name='description') }} + {{ render_markdown_editor(upload_form.description, field_name='description') }}
+ {% if config.USE_RECAPTCHA and not g.user %} +
+
+ {% for error in upload_form.recaptcha.errors %} + {{ error }} + {% endfor %} + {{ upload_form.recaptcha }} +
+
+ {% endif %} + +
+