Permission fixes

.gitignore

@@ -36,4 +36,5 @@ __pycache__
 *.pyc
 *.db
 .venv
-flaskbb/configs/flaskbb_dev.py
+flaskbb/configs/production.py
+flaskbb/configs/development.py

flaskbb/app.py

@@ -139,9 +139,7 @@ def configure_template_filters(app):
 
     @app.template_filter()
     def is_online(user):
-        if user.lastseen >= last_seen():
-            return True
-        return False
+        return user.lastseen >= last_seen()
 
     @app.template_filter()
     def is_current_user(user, post):
@@ -157,8 +155,8 @@ def configure_template_filters(app):
         """
         if can_moderate(user, forum):
             return True
-        if post.user_id == user.id and user.permissions['editpost']:
-            return True
+        if user.is_authenticated():
+            return post.user_id == user.id and user.permissions['editpost']
         return False
 
     @app.template_filter()
@@ -168,16 +166,16 @@ def configure_template_filters(app):
         """
         if can_moderate(user, forum):
             return True
-        if post.user_id == user.id and user.permissions['deletepost']:
-            return True
+        if user.is_authenticated():
+            return post.user_id == user.id and user.permissions['deletepost']
         return False
 
     @app.template_filter()
     def delete_topic(user, post, forum):
         if can_moderate(user, forum):
             return True
-        if post.user_id == user.id and user.permissions['deletetopic']:
-            return True
+        if user.is_authenticated():
+            return post.user_id == user.id and user.permissions['deletetopic']
         return False
 
 

flaskbb/user/models.py

@@ -70,7 +70,9 @@ class User(db.Model, UserMixin):
 
     primary_group_id = db.Column(db.Integer, db.ForeignKey('groups.id'))
 
-    primary_group = db.relationship('Group', backref="user_group", uselist=False, foreign_keys=[primary_group_id])
+    primary_group = db.relationship('Group', lazy="joined", backref="user_group", uselist=False, foreign_keys=[primary_group_id])
+
+    #pms = db.relationship("PrivateMessage", lazy="dynamic", primaryjoin=(PrivateMessage.user_id == id))
 
     groups = db.relationship('Group',
                              secondary=groups_users,
@@ -78,15 +80,8 @@ class User(db.Model, UserMixin):
                              backref=db.backref('users', lazy='dynamic'),
                              lazy='dynamic')
 
-    @property
-    def unread_count(self):
-        count = PrivateMessage.query.filter(
-            PrivateMessage.user_id == self.id,
-            PrivateMessage.draft == False,
-            PrivateMessage.trash == False,
-            PrivateMessage.unread == True,
-            db.not_(PrivateMessage.from_user_id == self.id)).count()
-        return count
+    unread_count = db.column_property(
+        db.select([db.func.count(PrivateMessage.id)]).where(PrivateMessage.user_id == id).where(PrivateMessage.unread == True).as_scalar())
 
     def __repr__(self):
         return "Username: %s" % self.username