1 files changed, 81 insertions, 6 deletions

diff --git a/mediagoblin/decorators.py b/mediagoblin/decorators.py
index 685d0d98..a3479164 100644
--- a/mediagoblin/decorators.py
+++ b/mediagoblin/decorators.py
@@ -22,8 +22,10 @@ from oauthlib.oauth1 import ResourceEndpoint
 
 from mediagoblin import mg_globals as mgg
 from mediagoblin import messages
-from mediagoblin.db.models import MediaEntry, User
-from mediagoblin.tools.response import json_response, redirect, render_404
+from mediagoblin.db.models import (MediaEntry, User, MediaComment,
+							UserBan, Privilege)
+from mediagoblin.tools.response import (redirect, render_404, 
+								render_user_banned, json_response)
 from mediagoblin.tools.translate import pass_to_ugettext as _
 
 from mediagoblin.oauth.tools.request import decode_authorization_header
@@ -36,11 +38,11 @@ def require_active_login(controller):
     @wraps(controller)
     def new_controller_func(request, *args, **kwargs):
         if request.user and \
-                request.user.status == u'needs_email_verification':
+                not request.user.has_privilege(u'active'):
             return redirect(
                 request, 'mediagoblin.user_pages.user_home',
                 user=request.user.username)
-        elif not request.user or request.user.status != u'active':
+        elif not request.user or not request.user.has_privilege(u'active'):
             next_url = urljoin(
                     request.urlgen('mediagoblin.auth.login',
                         qualified=True),
@@ -67,6 +69,22 @@ def active_user_from_url(controller):
 
     return wrapper
 
+def user_has_privilege(privilege_name):
+
+    def user_has_privilege_decorator(controller):
+        @wraps(controller)
+        def wrapper(request, *args, **kwargs):
+            user_id = request.user.id
+            if UserBan.query.filter(UserBan.user_id==user_id).count():
+                return render_user_banned(request)
+            elif not request.user.has_privilege(privilege_name):
+                raise Forbidden()
+
+            return controller(request, *args, **kwargs)
+
+        return wrapper
+    return user_has_privilege_decorator
+
 
 def user_may_delete_media(controller):
     """
@@ -75,7 +93,7 @@ def user_may_delete_media(controller):
     @wraps(controller)
     def wrapper(request, *args, **kwargs):
         uploader_id = kwargs['media'].uploader
-        if not (request.user.is_admin or
+        if not (request.user.has_privilege(u'admin') or
                 request.user.id == uploader_id):
             raise Forbidden()
 
@@ -92,7 +110,7 @@ def user_may_alter_collection(controller):
     def wrapper(request, *args, **kwargs):
         creator_id = request.db.User.query.filter_by(
             username=request.matchdict['user']).first().id
-        if not (request.user.is_admin or
+        if not (request.user.has_privilege(u'admin') or
                 request.user.id == creator_id):
             raise Forbidden()
 
@@ -256,6 +274,22 @@ def allow_registration(controller):
 
     return wrapper
 
+def get_media_comment_by_id(controller):
+    """
+    Pass in a MediaComment based off of a url component
+    """
+    @wraps(controller)
+    def wrapper(request, *args, **kwargs):
+        comment = MediaComment.query.filter_by(
+                id=request.matchdict['comment']).first()
+        # Still no media?  Okay, 404.
+        if not comment:
+            return render_404(request)
+
+        return controller(request, comment=comment, *args, **kwargs)
+
+    return wrapper
+
 
 def auth_enabled(controller):
     """Decorator for if an auth plugin is enabled"""
@@ -272,6 +306,47 @@ def auth_enabled(controller):
 
     return wrapper
 
+def require_admin_or_moderator_login(controller):
+    """
+    Require an login from an administrator or a moderator.
+    """
+    @wraps(controller)
+    def new_controller_func(request, *args, **kwargs):
+        if request.user and \
+            not request.user.has_privilege(u'admin',u'moderator'):
+
+            raise Forbidden()
+        elif not request.user:
+            next_url = urljoin(
+                    request.urlgen('mediagoblin.auth.login',
+                        qualified=True),
+                    request.url)
+
+            return redirect(request, 'mediagoblin.auth.login',
+                            next=next_url)
+
+        return controller(request, *args, **kwargs)
+
+    return new_controller_func
+
+
+def user_not_banned(controller):
+    """
+    Requires that the user has not been banned. Otherwise redirects to the page
+    explaining why they have been banned
+    """
+    @wraps(controller)
+    def wrapper(request, *args, **kwargs):
+        if request.user:
+            user_banned = UserBan.query.get(request.user.id)
+            if user_banned:
+                return render_user_banned(request)
+        return controller(request, *args, **kwargs)
+
+    return wrapper
+
+
+
 def oauth_required(controller):
     """ Used to wrap API endpoints where oauth is required """
     @wraps(controller)