Fix soft deleted and unapproved packages appearing where they shouldn't

diff --git a/app/models.py b/app/models.py
index 9db01f242f7ae829d4f73c0154fba0e44de11426..fbd8bad5e224f5f4b1bdd3137be2b73b8ed9b928 100644 (file)
--- a/app/models.py
+++ b/app/models.py
@@ -336,7 +336,7 @@ class Package(db.Model):
        forums       = db.Column(db.Integer,     nullable=True)
 
        provides = db.relationship("MetaPackage", secondary=provides, lazy="subquery",
-                       backref=db.backref("packages", lazy=True))
+                       backref=db.backref("packages", lazy="dynamic"))
 
        dependencies = db.relationship("Dependency", backref="depender", lazy="dynamic", foreign_keys=[Dependency.depender_id])
 

diff --git a/app/templates/meta/view.html b/app/templates/meta/view.html
index c5473b9d238ac924bb8e067ab192b2c1b250b277..7745ea9034f0e386b47048fd746f29282a79da51 100644 (file)
--- a/app/templates/meta/view.html
+++ b/app/templates/meta/view.html
@@ -8,5 +8,5 @@ Packages providing '{{ mpackage.name }}''
        <h1>Packages providing '{{ mpackage.name }}''</h1>
 
        {% from "macros/packagegridtile.html" import render_pkggrid %}
-       {{ render_pkggrid(mpackage.packages) }}
+       {{ render_pkggrid(mpackage.packages.filter_by(approved=True, soft_deleted=False).all()) }}
 {% endblock %}

diff --git a/app/templates/users/user_profile_page.html b/app/templates/users/user_profile_page.html
index f1ee6b5e5add92c409cadeb8641a74f9534d8844..062e9e8ecdd9c4be507095a668e688e1d5f26d82 100644 (file)
--- a/app/templates/users/user_profile_page.html
+++ b/app/templates/users/user_profile_page.html
@@ -49,7 +49,7 @@
        <h2>Packages</h2>
        <div class="box-body">
                <ul>
-                       {% for p in user.packages %}
+                       {% for p in packages %}
                                <li><a href="{{ p.getDetailsURL() }}">
                                        {{ p.title }} by {{ p.author.display_name }}
                                </a></li>

diff --git a/app/views/users.py b/app/views/users.py
index 62bc6f2c1973eac94aec1683beabae704e3e034d..b68c10391c1f19e49428df5b8931e084c577a9b5 100644 (file)
--- a/app/views/users.py
+++ b/app/views/users.py
@@ -49,6 +49,10 @@ def user_profile_page(username):
        if not user:
                abort(404)
 
+       packages = user.packages.filter_by(soft_deleted=False)
+       if not current_user.is_authenticated or (user != current_user and not current_user.canAccessTodoList()):
+               packages = packages.filter_by(approved=True)
+
        form = None
        if user.checkPerm(current_user, Permission.CHANGE_DNAME) or \
                        user.checkPerm(current_user, Permission.CHANGE_EMAIL) or \
@@ -92,7 +96,7 @@ def user_profile_page(username):
 
        # Process GET or invalid POST
        return render_template("users/user_profile_page.html",
-                       user=user, form=form)
+                       user=user, form=form, packages=packages)
 
 
 @app.route("/users/claim/", methods=["GET", "POST"])