misc (#1396)

tiny fixes and improvements that I’d have pushed directly at one time, but requiring every change to main to pass through a PR so diffs can be verified in a clean environment is an important security step

docker-compose.yml

@@ -137,17 +137,18 @@ services:
           if test $$i -ge 8; then
             exit 1
           fi
-          if test -n "$$(.venv/bin/alembic -c /run/config/alembic.ini current 2> /dev/null)"; then
+          if test -n "$$(.venv/bin/alembic current 2> /dev/null)"; then
             break
           fi
           i=$$((i + 1))
           printf 'checking if postgres is up in %i seconds...\n' $$i
           sleep $$i
         done
-        exec .venv/bin/alembic -c /run/config/alembic.ini upgrade head
+        exec .venv/bin/alembic upgrade head
     environment:
       # needed for revision f30dc3b5856a
       WEASYL_STORAGE_ROOT: /fakepath
+      ALEMBIC_CONFIG: /run/config/alembic.ini
     volumes:
       - config:/run/config:ro
     networks:

weasyl/character.py

@@ -369,7 +369,9 @@ def edit(userid, character, friends_only):
         raise WeasylError("characterNameInvalid")
     elif not character.rating:
         raise WeasylError("Unexpected")
-    profile.check_user_rating_allowed(userid, character.rating)
+
+    if userid == query.userid:
+        profile.check_user_rating_allowed(userid, character.rating)
 
     if friends_only:
         welcome.character_remove(character.charid)

weasyl/journal.py

@@ -267,7 +267,6 @@ def edit(userid, journal, friends_only=False):
         raise WeasylError("contentInvalid")
     elif not journal.rating:
         raise WeasylError("ratingInvalid")
-    profile.check_user_rating_allowed(userid, journal.rating)
 
     query = d.engine.execute(
         "SELECT userid, hidden FROM journal WHERE journalid = %(id)s",
@@ -279,6 +278,9 @@ def edit(userid, journal, friends_only=False):
     elif userid != query[0] and userid not in staff.MODS:
         raise WeasylError("InsufficientPermissions")
 
+    if userid == query.userid:
+        profile.check_user_rating_allowed(userid, journal.rating)
+
     if friends_only:
         welcome.journal_remove(journal.journalid)
 

weasyl/profile.py

@@ -683,16 +683,15 @@ def edit_preferences(userid,
             config = config.replace(i, "")
         config_str = config + preferences.to_code()
         updates['config'] = config_str
-        d._get_all_config.invalidate(userid)
     if jsonb_settings is not None:
         # update jsonb preferences
         updates['jsonb_settings'] = jsonb_settings.get_raw()
-        d._get_all_config.invalidate(userid)
 
     d.engine.execute(
         t.profile.update().where(t.profile.c.userid == userid),
         updates
     )
+    d._get_all_config.invalidate(userid)
 
 
 def select_manage(userid):

weasyl/submission.py

@@ -974,13 +974,15 @@ def edit(userid, submission, embedlink=None, friends_only=False, critique=False)
         raise WeasylError("embedlinkInvalid")
     elif 'google-drive' == query[3]:
         embedlink = _normalize_google_docs_embed(embedlink)
-    profile.check_user_rating_allowed(userid, submission.rating)
+
+    if userid == query.userid:
+        profile.check_user_rating_allowed(userid, submission.rating)
 
     if 'other' == query[3]:
         submission.content = "%s\n%s" % (embedlink, submission.content)
 
     if friends_only:
-        welcome.submission_became_friends_only(submission.submitid, userid)
+        welcome.submission_became_friends_only(submission.submitid, query.userid)
 
     # TODO(kailys): maintain ORM object
     db = d.connect()

weasyl/test/login/test_get_account_verification_token.py

@@ -3,7 +3,6 @@
 
 from weasyl import login
 from weasyl import define as d
-from weasyl.test.utils import Bag
 
 
 user_name = "test"
@@ -16,33 +15,27 @@
 
 @pytest.mark.usefixtures('db')
 def test_acct_verif_token_returned_if_email_provided_to_function():
-    form = Bag(username=user_name, password='0123456789',
-               email=email_addr,
-               day='12', month='12', year=arrow.utcnow().year - 19)
     d.engine.execute(d.meta.tables["logincreate"].insert(), {
         "token": token,
-        "username": form.username,
-        "login_name": form.username,
+        "username": user_name,
+        "login_name": user_name,
         "hashpass": login.passhash(raw_password),
-        "email": form.email,
+        "email": email_addr,
         "birthday": arrow.Arrow(2000, 1, 1),
     })
-    acct_verification_token = login.get_account_verification_token(email=form.email, username=None)
+    acct_verification_token = login.get_account_verification_token(email=email_addr, username=None)
     assert token == acct_verification_token
 
 
 @pytest.mark.usefixtures('db')
 def test_acct_verif_token_returned_if_username_provided_to_function():
-    form = Bag(username=user_name, password='0123456789',
-               email=email_addr,
-               day='12', month='12', year=arrow.utcnow().year - 19)
     d.engine.execute(d.meta.tables["logincreate"].insert(), {
         "token": token,
-        "username": form.username,
-        "login_name": form.username,
+        "username": user_name,
+        "login_name": user_name,
         "hashpass": login.passhash(raw_password),
-        "email": form.email,
+        "email": email_addr,
         "birthday": arrow.Arrow(2000, 1, 1),
     })
-    acct_verification_token = login.get_account_verification_token(email=None, username=form.username)
+    acct_verification_token = login.get_account_verification_token(email=None, username=user_name)
     assert token == acct_verification_token