diff options
Diffstat (limited to 'mediagoblin/edit/views.py')
| -rw-r--r-- | mediagoblin/edit/views.py | 29 |
1 files changed, 27 insertions, 2 deletions
diff --git a/mediagoblin/edit/views.py b/mediagoblin/edit/views.py index a9071495..e064a9c3 100644 --- a/mediagoblin/edit/views.py +++ b/mediagoblin/edit/views.py @@ -17,6 +17,7 @@ from webob import exc +from mediagoblin import messages from mediagoblin.util import render_to_response, redirect, clean_html from mediagoblin.edit import forms from mediagoblin.edit.lib import may_edit_media @@ -63,6 +64,14 @@ def edit_media(request, media): return redirect(request, "mediagoblin.user_pages.media_home", user=media.uploader()['username'], media=media['slug']) + if request.user['is_admin'] \ + and media['uploader'] != request.user['_id'] \ + and request.method != 'POST': + messages.add_message( + request, messages.WARNING, + "You are editing another user's media. Proceed with caution.") + + return render_to_response( request, 'mediagoblin/edit/edit.html', @@ -73,7 +82,18 @@ def edit_media(request, media): @require_active_login def edit_profile(request): - user = request.user + # admins may edit any user profile given a username in the querystring + edit_username = request.GET.get('username') + if request.user['is_admin'] and request.user['username'] != edit_username: + user = request.db.User.find_one({'username': edit_username}) + # No need to warn again if admin just submitted an edited profile + if request.method != 'POST': + messages.add_message( + request, messages.WARNING, + "You are editing a user's profile. Proceed with caution.") + else: + user = request.user + form = forms.EditProfileForm(request.POST, url = user.get('url'), bio = user.get('bio')) @@ -83,7 +103,12 @@ def edit_profile(request): user['bio'] = request.POST['bio'] user.save() - return redirect(request, "index", user=user['username']) + messages.add_message(request, + messages.SUCCESS, + 'Profile edited!') + return redirect(request, + "mediagoblin.edit.profile", + username=edit_username) return render_to_response( request, |