external/aurweb
0
0
Fork 0
mirror of https://gitlab.archlinux.org/archlinux/aurweb.git synced 2025-02-03 10:43:03 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix: only reject addvote for users with running proposals

Browse source 
This was incorrectly indiscriminately targetting _any_ proposal
for a particular user.

Signed-off-by: Kevin Morris <kevr@0cost.org>
This commit is contained in:
Kevin Morris 2022-03-07 23:23:49 -08:00
parent c7c79a152b
commit 6a243e90db
No known key found for this signature in database
GPG key ID: F7E46DED420788F3
1 changed files with 3 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
aurweb/routers/trusted_user.py
View file

@ -274,8 +274,10 @@ async def trusted_user_addvote_post(request: Request,
context["error"] = "Username does not exist." context["error"] = "Username does not exist."
return render_addvote(context, HTTPStatus.NOT_FOUND) return render_addvote(context, HTTPStatus.NOT_FOUND)
utcnow = time.utcnow()
voteinfo = db.query(models.TUVoteInfo).filter( voteinfo = db.query(models.TUVoteInfo).filter(
models.TUVoteInfo.User == user).count() and_(models.TUVoteInfo.User == user,
models.TUVoteInfo.End > utcnow)).count()
if voteinfo: if voteinfo:
_ = l10n.get_translator_for_request(request) _ = l10n.get_translator_for_request(request)
context["error"] = _( context["error"] = _(