Check proper permissions before exporting an event

Author: prateekj117

app/api/exports.py

@@ -5,9 +5,8 @@
 from flask_jwt_extended import jwt_required, current_user
 
 from app.api.helpers.export_helpers import export_event_json, create_export_job
+from app.api.helpers.permissions import is_coorganizer
 from app.api.helpers.utilities import TASK_RESULTS
-from app.models import db
-from app.models.event import Event
 
 export_routes = Blueprint('exports', __name__, url_prefix='/v1')
 
@@ -20,8 +19,8 @@
 
 
 @export_routes.route('/events/<string:event_identifier>/export/json', methods=['POST'])
-@jwt_required
-def export_event(event_identifier):
+@is_coorganizer
+def export_event(event_id):
     from .helpers.tasks import export_event_task
 
     settings = EXPORT_SETTING
@@ -30,11 +29,6 @@ def export_event(event_identifier):
     settings['document'] = request.json.get('document', False)
     settings['audio'] = request.json.get('audio', False)
 
-    if not event_identifier.isdigit():
-        event = db.session.query(Event).filter_by(identifier=event_identifier).first()
-        event_id = event.id
-    else:
-        event_id = event_identifier
     # queue task
     task = export_event_task.delay(
         current_user.email, event_id, settings)
@@ -54,7 +48,7 @@ def export_event(event_identifier):
 
 
 @export_routes.route('/events/<string:event_id>/exports/<path:path>')
-@jwt_required
+@is_coorganizer
 def export_download(event_id, path):
     if not path.startswith('/'):
         path = '/' + path
@@ -66,14 +60,8 @@ def export_download(event_id, path):
 
 
 @export_routes.route('/events/<string:event_identifier>/export/xcal', methods=['GET'])
-@jwt_required
-def export_event_xcal(event_identifier):
-
-    if not event_identifier.isdigit():
-        event = db.session.query(Event).filter_by(identifier=event_identifier).first()
-        event_id = str(event.id)
-    else:
-        event_id = event_identifier
+@is_coorganizer
+def export_event_xcal(event_id):
 
     from .helpers.tasks import export_xcal_task
 
@@ -95,13 +83,8 @@ def event_export_task_base(event_id, settings):
 
 
 @export_routes.route('/events/<string:event_identifier>/export/ical', methods=['GET'])
-@jwt_required
-def export_event_ical(event_identifier):
-    if not event_identifier.isdigit():
-        event = db.session.query(Event).filter_by(identifier=event_identifier).first()
-        event_id = str(event.id)
-    else:
-        event_id = event_identifier
+@is_coorganizer
+def export_event_ical(event_id):
 
     from .helpers.tasks import export_ical_task
 
@@ -115,13 +98,8 @@ def export_event_ical(event_identifier):
 
 
 @export_routes.route('/events/<string:event_identifier>/export/pentabarf', methods=['GET'])
-@jwt_required
-def export_event_pentabarf(event_identifier):
-    if not event_identifier.isdigit():
-        event = db.session.query(Event).filter_by(identifier=event_identifier).first()
-        event_id = str(event.id)
-    else:
-        event_id = event_identifier
+@is_coorganizer
+def export_event_pentabarf(event_id):
 
     from .helpers.tasks import export_pentabarf_task
 
@@ -135,13 +113,8 @@ def export_event_pentabarf(event_identifier):
 
 
 @export_routes.route('/events/<string:event_identifier>/export/orders/csv', methods=['GET'])
-@jwt_required
-def export_orders_csv(event_identifier):
-    if not event_identifier.isdigit():
-        event = db.session.query(Event).filter_by(identifier=event_identifier).first()
-        event_id = str(event.id)
-    else:
-        event_id = event_identifier
+@is_coorganizer
+def export_orders_csv(event_id):
 
     from .helpers.tasks import export_order_csv_task
 
@@ -155,13 +128,8 @@ def export_orders_csv(event_identifier):
 
 
 @export_routes.route('/events/<string:event_identifier>/export/orders/pdf', methods=['GET'])
-@jwt_required
-def export_orders_pdf(event_identifier):
-    if not event_identifier.isdigit():
-        event = db.session.query(Event).filter_by(identifier=event_identifier).first()
-        event_id = str(event.id)
-    else:
-        event_id = event_identifier
+@is_coorganizer
+def export_orders_pdf(event_id):
 
     from .helpers.tasks import export_order_pdf_task
 
@@ -175,13 +143,8 @@ def export_orders_pdf(event_identifier):
 
 
 @export_routes.route('/events/<string:event_identifier>/export/attendees/csv', methods=['GET'])
-@jwt_required
-def export_attendees_csv(event_identifier):
-    if not event_identifier.isdigit():
-        event = db.session.query(Event).filter_by(identifier=event_identifier).first()
-        event_id = str(event.id)
-    else:
-        event_id = event_identifier
+@is_coorganizer
+def export_attendees_csv(event_id):
 
     from .helpers.tasks import export_attendees_csv_task
 
@@ -195,13 +158,8 @@ def export_attendees_csv(event_identifier):
 
 
 @export_routes.route('/events/<string:event_identifier>/export/attendees/pdf', methods=['GET'])
-@jwt_required
-def export_attendees_pdf(event_identifier):
-    if not event_identifier.isdigit():
-        event = db.session.query(Event).filter_by(identifier=event_identifier).first()
-        event_id = str(event.id)
-    else:
-        event_id = event_identifier
+@is_coorganizer
+def export_attendees_pdf(event_id):
 
     from .helpers.tasks import export_attendees_pdf_task
 
@@ -215,13 +173,8 @@ def export_attendees_pdf(event_identifier):
 
 
 @export_routes.route('/events/<string:event_identifier>/export/sessions/csv', methods=['GET'])
-@jwt_required
-def export_sessions_csv(event_identifier):
-    if not event_identifier.isdigit():
-        event = db.session.query(Event).filter_by(identifier=event_identifier).first()
-        event_id = str(event.id)
-    else:
-        event_id = event_identifier
+@is_coorganizer
+def export_sessions_csv(event_id):
 
     from .helpers.tasks import export_sessions_csv_task
 
@@ -235,13 +188,8 @@ def export_sessions_csv(event_identifier):
 
 
 @export_routes.route('/events/<string:event_identifier>/export/speakers/csv', methods=['GET'])
-@jwt_required
-def export_speakers_csv(event_identifier):
-    if not event_identifier.isdigit():
-        event = db.session.query(Event).filter_by(identifier=event_identifier).first()
-        event_id = str(event.id)
-    else:
-        event_id = event_identifier
+@is_coorganizer
+def export_speakers_csv(event_id):
 
     from .helpers.tasks import export_speakers_csv_task
 
@@ -255,13 +203,8 @@ def export_speakers_csv(event_identifier):
 
 
 @export_routes.route('/events/<string:event_identifier>/export/sessions/pdf', methods=['GET'])
-@jwt_required
-def export_sessions_pdf(event_identifier):
-    if not event_identifier.isdigit():
-        event = db.session.query(Event).filter_by(identifier=event_identifier).first()
-        event_id = str(event.id)
-    else:
-        event_id = event_identifier
+@is_coorganizer
+def export_sessions_pdf(event_id):
 
     from .helpers.tasks import export_sessions_pdf_task
 
@@ -275,13 +218,8 @@ def export_sessions_pdf(event_identifier):
 
 
 @export_routes.route('/events/<string:event_identifier>/export/speakers/pdf', methods=['GET'])
-@jwt_required
-def export_speakers_pdf(event_identifier):
-    if not event_identifier.isdigit():
-        event = db.session.query(Event).filter_by(identifier=event_identifier).first()
-        event_id = str(event.id)
-    else:
-        event_id = event_identifier
+@is_coorganizer
+def export_speakers_pdf(event_id):
 
     from .helpers.tasks import export_speakers_pdf_task
 

app/api/helpers/permissions.py

@@ -3,6 +3,8 @@
 from flask_jwt_extended import verify_jwt_in_request, current_user
 
 from app.api.helpers.db import save_to_db
+from app.models import db
+from app.models.event import Event
 from app.api.helpers.errors import ForbiddenError
 from flask import request
 from datetime import datetime
@@ -157,6 +159,11 @@ def is_coorganizer(f):
     def decorated_function(*args, **kwargs):
         user = current_user
 
+        if 'event_identifier' in kwargs:
+            event = db.session.query(Event).filter_by(identifier=kwargs['event_identifier']).first()
+            kwargs['event_id'] = str(event.id)
+            kwargs.pop('event_identifier', None)
+
         if user.is_staff:
             return f(*args, **kwargs)
         if 'event_id' in kwargs and user.has_event_access(kwargs['event_id']):