diff --git a/nyaa/routes.py b/nyaa/routes.py index ecc3df9..0168b2a 100644 --- a/nyaa/routes.py +++ b/nyaa/routes.py @@ -571,13 +571,16 @@ def upload(): return flask.render_template('upload.html', upload_form=upload_form), status_code -@app.route('/view/') +@app.route('/view/', methods=['GET', 'POST']) def view_torrent(torrent_id): - torrent = models.Torrent.query \ - .options(joinedload('filelist'), - joinedload('comments')) \ - .filter_by(id=torrent_id) \ - .first() + if flask.request.method == 'POST': + torrent = models.Torrent.by_id(torrent_id) + else: + torrent = models.Torrent.query \ + .options(joinedload('filelist'), + joinedload('comments')) \ + .filter_by(id=torrent_id) \ + .first() if not torrent: flask.abort(404) @@ -585,6 +588,29 @@ def view_torrent(torrent_id): if torrent.deleted and not (flask.g.user and flask.g.user.is_moderator): flask.abort(404) + comment_form = None + if flask.g.user: + comment_form = forms.CommentForm() + + if flask.request.method == 'POST': + if not flask.g.user: + flask.abort(403) + + if comment_form.validate(): + comment_text = (comment_form.comment.data or '').strip() + + comment = models.Comment( + torrent_id=torrent_id, + user_id=flask.g.user.id, + text=comment_text) + + db.session.add(comment) + db.session.commit() + + flask.flash('Comment successfully posted.', 'success') + + return flask.redirect(flask.url_for('view_torrent', torrent_id=torrent_id)) + # Only allow owners and admins to edit torrents can_edit = flask.g.user and (flask.g.user is torrent.user or flask.g.user.is_moderator) @@ -592,10 +618,6 @@ def view_torrent(torrent_id): if torrent.filelist: files = json.loads(torrent.filelist.filelist_blob.decode('utf-8')) - comment_form = None - if flask.g.user: - comment_form = forms.CommentForm() - return flask.render_template('view.html', torrent=torrent, files=files, comment_form=comment_form, @@ -603,30 +625,6 @@ def view_torrent(torrent_id): can_edit=can_edit) -@app.route('/view//comment', methods=['POST']) -def submit_comment(torrent_id): - if not flask.g.user: - flask.abort(403) - - torrent = models.Torrent.by_id(torrent_id) - if not torrent: - flask.abort(404) - - form = forms.CommentForm(flask.request.form) - if form.validate(): - comment_text = (form.comment.data or '').strip() - - comment = models.Comment( - torrent_id=torrent_id, - user_id=flask.g.user.id, - text=comment_text) - - db.session.add(comment) - db.session.commit() - - return flask.redirect(flask.url_for('view_torrent', torrent_id=torrent_id)) - - @app.route('/view//comment//delete', methods=['POST']) def delete_comment(torrent_id, comment_id): if not flask.g.user: diff --git a/nyaa/templates/view.html b/nyaa/templates/view.html index a2d7c7e..3494703 100644 --- a/nyaa/templates/view.html +++ b/nyaa/templates/view.html @@ -176,7 +176,7 @@ {% endfor %} {% if comment_form %} -
+ {{ comment_form.csrf_token }} {{ render_field(comment_form.comment, class_='form-control') }}