From 96468a5a118b51a58f569e85e00b2861a34a70ed Mon Sep 17 00:00:00 2001 From: Nicolas F Date: Fri, 3 Nov 2017 17:54:08 +0100 Subject: [PATCH] torrents: don't allow download of deleted torrents (#399) Only allow moderators to download torrent files that are deleted. --- nyaa/views/torrents.py | 3 +++ 1 file changed, 3 insertions(+) diff --git a/nyaa/views/torrents.py b/nyaa/views/torrents.py index 9cb4bd1..ebba437 100644 --- a/nyaa/views/torrents.py +++ b/nyaa/views/torrents.py @@ -316,6 +316,9 @@ def download_torrent(torrent_id): if not torrent or not torrent.has_torrent: flask.abort(404) + if torrent.deleted and not (flask.g.user and flask.g.user.is_moderator): + flask.abort(404) + torrent_file, torrent_file_size = _get_cached_torrent_file(torrent) disposition = 'inline; filename="{0}"; filename*=UTF-8\'\'{0}'.format( quote(torrent.torrent_name.encode('utf-8')))