Fix permission issues on portal. #167

flaskbb/plugins/portal/views.py

@@ -1,10 +1,11 @@
 # -*- coding: utf-8 -*-
 from flask import Blueprint, current_app, flash, request
 from flask_babelex import gettext as _
+from flask_login import current_user
 
 from flaskbb.utils.helpers import render_template
-from flaskbb.forum.models import Topic, Post
-from flaskbb.user.models import User
+from flaskbb.forum.models import Topic, Post, Forum
+from flaskbb.user.models import User, Group
 from flaskbb.utils.helpers import time_diff, get_online_users
 from flaskbb.utils.settings import flaskbb_config
 
@@ -22,16 +23,26 @@ def index():
     try:
         forum_ids = flaskbb_config["PLUGIN_PORTAL_FORUM_IDS"]
     except KeyError:
-        forum_ids = [1]
+        forum_ids = []
         flash(_("Please install the plugin first to configure the forums "
               "which should be displayed"), "warning")
 
-    news = Topic.query.filter(Topic.forum_id.in_(forum_ids)).\
+
+    group_ids = [group.id for group in current_user.groups]
+    forums = Forum.query.filter(Forum.groups.any(Group.id.in_(group_ids)))
+
+    # get the news forums - check for permissions
+    news_ids = [f.id for f in forums.filter(Forum.id.in_(forum_ids)).all()]
+    news = Topic.query.filter(Topic.forum_id.in_(news_ids)).\
         order_by(Topic.id.desc()).\
         paginate(page, flaskbb_config["TOPICS_PER_PAGE"], True)
 
-    recent_topics = Topic.query.order_by(Topic.last_updated.desc()).limit(
-                            flaskbb_config.get("PLUGIN_PORTAL_RECENT_TOPICS", 10))
+    # get the recent topics from all to the user available forums (not just the
+    # configured ones)
+    all_ids = [f.id for f in forums.all()]
+    recent_topics = Topic.query.filter(Topic.forum_id.in_(all_ids)).\
+        order_by(Topic.last_updated.desc()).\
+        limit(flaskbb_config.get("PLUGIN_PORTAL_RECENT_TOPICS", 10))
 
     user_count = User.query.count()
     topic_count = Topic.query.count()
@@ -41,9 +52,6 @@ def index():
     # Check if we use redis or not
     if not current_app.config["REDIS_ENABLED"]:
         online_users = User.query.filter(User.lastseen >= time_diff()).count()
-
-        # Because we do not have server side sessions, we cannot check if there
-        # are online guests
         online_guests = None
     else:
         online_users = len(get_online_users())