Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
def groups():
form = None
if not app.config["GROUPS_ENABLED"] and not current_user.groups:
abort(404)
if app.config["GROUPS_ENABLED"]:
form = CreateGroupForm()
if form.validate_on_submit():
group = Group()
group.source = "manual"
group.admin = current_user
group.users.append(current_user)
form.populate_obj(group)
db.session.add(group)
db.session.commit()
flash(gettext("The group was created."), "success")
return redirect(url_for('group', id=group.id))
def _format_response(response, format='.json', template=None):
"""
Return response as a particular format.
"""
#print "response",response
if format == '.html':
if template is None: flask.abort(400)
return flask.render_template(template, **response)
elif format in ('', '.json'):
return flask.jsonify(**dict((str(k),v) for k,v in response.items()))
elif format == '.pickle':
return pickle.dumps(response)
else:
flask.abort(400) # Bad request
@testcase
def resetAccountExpirationWorker(emailAddress, sessionId):
try:
if not authentication.checkSessionId(sessionId, ADMIN):
abort(403)
util.debugPrint("resetAccountExpiration")
return jsonify(AccountsManagement.resetAccountExpiration(
emailAddress))
except:
print "Unexpected error:", sys.exc_info()[0]
print sys.exc_info()
traceback.print_exc()
util.logStackTrace(sys.exc_info())
raise
hash = binascii.unhexlify(hexstr)
except TypeError:
abort(400)
if len(hash) != 32:
abort(400)
# get sqlite handle
connection = HASHFS_DB
cursor = connection.cursor()
# query for metadata
md = {}
row = cursor.execute(SQLS_HASH_QUERY, (hexstr,)).fetchone()
if row is None:
abort(404)
md['size'] = int(row[0])
md['created'] = int(row[1])
md['expires'] = int(row[2])
md['content_type'] = row[3]
# set up FileWrapper to return data
filename = make_hashfs_fn(hexstr)
try:
body = open(filename, 'rb').read()
except:
app.logger.error("failed read " + filename)
abort(500)
if len(body) != md['size']:
def need_record_permission_decorator(self, *args,
**kwargs):
permission_factory = (getattr(self, factory_name))
if permission_factory:
if not permission_factory.can():
from flask_login import current_user
if not current_user.is_authenticated:
abort(401)
abort(403)
return f(self, *args, **kwargs)
return need_record_permission_decorator
if self.auth.account.account_type == "senior_admin" or in_global_acl:
return allperms
if domain.owner_id == self.auth.account.account_id:
return allperms
for map in dgmaps:
if map.domain_id == domain.domain_id:
return {
"can_read": map.has_perm(DomainGroupMap.READ_PERM),
"can_write": map.has_perm(DomainGroupMap.WRITE_PERM),
"can_delete": map.has_perm(DomainGroupMap.DELETE_PERM),
}
# should not get here
raise abort(500, message="Unable to determine domain permissions")
if identifier.startswith('recid:'):
record_id, filename = _parse_legacy_syntax(identifier)
fullpath, permissions = _get_legacy_bibdoc(
record_id, filename=filename
)
else:
fullpath, permissions = _get_document(identifier)
if path_only:
return fullpath
try:
assert (permissions[0] == 0)
except AssertionError:
return abort(403)
def inner(*args, **kwargs):
user = self.auth.get_logged_in_user()
if not user:
login_url = url_for('%s.login' % self.auth.blueprint.name, next=get_next())
return redirect(login_url)
if not self.check_user_permission(user):
abort(403)
return func(*args, **kwargs)
return inner
def inner(self, *args, **kwargs):
mimetype = request.view_args['mimetype']
if mimetype not in _mimetype_whitelist():
abort(400, '"{}" is not an acceptable mimetype.'.format(mimetype))
return f(self, *args, **kwargs)
return inner