@ -9,21 +9,19 @@ from flask_migrate import Migrate
from sqlalchemy . sql . expression import func
from mastodon import Mastodon
from models import db , User , Post , Comment , Attention , TagRecord , Syslog , SearchDB
from utils import get_current_username , map_post , map_comments , map_syslog , check_attention , hash_name , look , get_num , tmp_token , is_admin , check_can_del , rds , RDS_KEY_POLL_OPTS , RDS_KEY_POLL_VOTES , gen_poll_dict , name_with_tmp_limit , RDS_KEY_BLOCK_SET , RDS_KEY_BLOCKED_COUNT , RDS_KEY_DANGEROUS_USERS , RDS_KEY_TITLE
from models import db , User , Post , Comment , Attention , TagRecord , Syslog
from utils import get_current_user , map_post , map_comment , map_syslog , check_attention , hash_name , look , get_num , tmp_token , is_admin
app = Flask ( __name__ )
app . config [ ' SQLALCHEMY_DATABASE_URI ' ] = ' sqlite:///hole.db '
app . config [ ' SQLALCHEMY_TRACK_MODIFICATIONS ' ] = False
app . config [ ' JSON_AS_ASCII ' ] = False
app . config [ ' SALT ' ] = ' ' . join ( random . choices (
string . ascii_letters + string . digits , k = 32
) )
app . config . from_pyfile ( ' config.py ' )
db . init_app ( app )
migrate = Migrate ( app , db )
CS_LOGIN_URL = Mastodon ( api_base_url = app . config [ ' MASTODON_URL ' ] ) \
. auth_request_url (
client_id = app . config [ ' CLIENT_ID ' ] ,
@ -38,22 +36,6 @@ limiter = Limiter(
)
PER_PAGE = 50
DANGEROUS_USER_THRESHOLD = 10
class APIError ( Exception ) :
msg = ' 未知错误 '
def __init__ ( self , msg ) :
self . msg = msg
def __str__ ( self ) :
return str ( self . msg )
@app . errorhandler ( APIError )
def handle_api_error ( e ) :
return { ' code ' : 1 , ' msg ' : e . msg }
@app . route ( ' /_login ' )
@ -104,7 +86,7 @@ def auth():
@app . route ( ' /_api/v1/getlist ' )
def get_list ( ) :
username = get_current_username ( )
u = get_current_user ( )
p = request . args . get ( ' p ' , type = int , default = 1 )
order_mode = request . args . get ( ' order_mode ' , type = int , default = 0 )
@ -129,12 +111,11 @@ def get_list():
posts = query . order_by ( order ) . paginate ( p , PER_PAGE )
data = list ( map ( map_post , posts . items , [ user name ] * len ( posts . items ) ) )
data = list ( map ( map_post , posts . items , [ u . name ] * len ( posts . items ) ) )
return {
' code ' : 0 ,
' tmp_token ' : tmp_token ( ) ,
' custom_title ' : rds . hget ( RDS_KEY_TITLE , hash_name ( username ) ) ,
' count ' : len ( data ) ,
' data ' : data
}
@ -142,39 +123,15 @@ def get_list():
@app . route ( ' /_api/v1/getone ' )
def get_one ( ) :
username = get_current_username ( )
u = get_current_user ( )
pid = request . args . get ( ' pid ' , type = int )
post = Post . query . get_or_404 ( pid )
if post . deleted or post . is_reported and not (
check_can_del ( username , post . name_hash )
) :
if post . deleted or post . is_reported :
abort ( 451 )
data = map_post ( post , username )
return {
' code ' : 0 ,
' data ' : data
}
@app . route ( ' /_api/v1/getmulti ' )
def get_multi ( ) :
username = get_current_username ( )
pids = request . args . getlist ( ' pids ' )
pids = pids [ : 500 ] or [ 0 ]
posts = Post . query . filter (
Post . id . in_ ( pids )
) . filter_by (
deleted = False
) . order_by (
Post . id . desc ( )
) . all ( )
data = [ map_post ( post , username ) for post in posts ]
data = map_post ( post , u . name )
return {
' code ' : 0 ,
@ -184,75 +141,43 @@ def get_multi():
@app . route ( ' /_api/v1/search ' )
def search ( ) :
username = get_current_username ( )
u = get_current_user ( )
page = request . args . get ( ' page ' , type = int , default = 1 )
search_mode = request . args . get ( ' search_mode ' , type = int )
pagesize = min ( request . args . get ( ' pagesize ' , type = int , default = PER_PAGE ) , 2 * PER_PAGE )
keywords = request . args . get ( ' keywords ' , ' ' ) . strip ( )
pagesize = min ( request . args . get ( ' pagesize ' , type = int , default = 200 ) , 200 )
keywords = request . args . get ( ' keywords ' )
if not keywords :
raise APIError ( " 搜索词不可为空 " )
if search_mode is None :
raise APIError ( " 请点击“强制检查更新”，更新网页到最新版 " )
data = [ ]
abort ( 422 )
if search_mode == 0 : # tag 搜索
tag_pids = TagRecord . query . with_entities (
TagRecord . pid
) . filter_by ( tag = keywords ) . ord er_by (
TagRecord . pid . desc ( )
) . limit ( pagesize ) . offset ( ( page - 1 ) * pagesize ) . all ( )
) . filter_by (
tag = keywords
) . all ( )
tag_pids = [
tag_pid for tag_pid , in tag_pids ] or [ 0 ] # sql not allowed empty in
tag_pids = [ tag_pid for tag_pid , in tag_pids ] or [ 0 ] # sql not allowed empty in
posts = Post . query . filter ( Post . id . in_ ( tag_pids ) ) . filter_by (
posts = Post . query . filter (
Post . search_text . like ( " % {} % " . format ( keywords ) )
) . filter (
Post . id . notin_ ( tag_pids )
) . filter_by (
deleted = False , is_reported = False
) . order_by ( Post . id . desc ( ) ) . all ( )
data = [
map_post ( post , username )
for post in posts
]
elif search_mode == 1 : # 全文搜索
search_db = SearchDB ( )
for highlighted_content , obj_type , obj_id in search_db . query (
keywords , pagesize , ( page - 1 ) * pagesize
) :
if obj_type == ' post ' :
obj = Post . query . get ( obj_id )
else :
obj = Comment . query . get ( obj_id )
if not obj or obj . deleted :
continue
if obj_type == ' post ' :
post = obj
else :
post = obj . post
if not post or post . deleted or post . is_reported :
continue
obj . content = highlighted_content
if obj_type == ' post ' :
post_dict = map_post ( post , username )
else :
post_dict = map_post ( post , username , 1000 )
post_dict [ ' comments ' ] = [
c for c in post_dict [ ' comments ' ] if c [ ' cid ' ] == obj_id
]
) . order_by (
Post . id . desc ( )
) . limit ( pagesize ) . offset ( ( page - 1 ) * pagesize ) . all ( )
post_dict [ ' key ' ] = " search_ %s _ %s " % ( obj_type , obj_id )
data . append ( post_dict )
del search_db
elif search_mode == 2 : # 头衔
posts = Post . query . filter_by ( author_title = keywords ) . filter_by (
if page == 1 :
posts = Post . query . filter (
Post . id . in_ ( tag_pids )
) . filter_by (
deleted = False , is_reported = False
) . order_by (
Post . id . desc ( )
) . limit ( pagesize ) . offset ( ( page - 1 ) * pagesize ) . all ( )
) . all ( ) + posts
data = [
map_post ( post , user name )
map_post ( post , u . name )
for post in posts
]
@ -266,61 +191,56 @@ def search():
@app . route ( ' /_api/v1/dopost ' , methods = [ ' POST ' ] )
@limiter . limit ( " 50 / hour; 1 / 3 second " )
def do_post ( ) :
username = get_current_username ( )
u = get_current_user ( )
allow_search = request . form . get ( ' allow_search ' )
content = request . form . get ( ' text ' , ' ' ) . strip ( )
content = ( ' [tmp] \n ' if username [ : 4 ] == ' tmp_ ' else ' ' ) + content
print ( allow_search )
content = request . form . get ( ' text ' )
content = content . strip ( ) if content else None
content = ' [tmp] \n ' + content if u . name [ : 4 ] == ' tmp_ ' else content
post_type = request . form . get ( ' type ' )
cw = request . form . get ( ' cw ' , ' ' ) . strip ( )
poll_options = request . form . getlist ( ' poll_options ' )
use_title = request . form . get ( ' use_title ' )
if not content or len ( content ) > 4096 or len ( cw ) > 32 :
raise APIError ( ' 无内容或超长 ' )
if poll_options and poll_options [ 0 ] :
if len ( poll_options ) != len ( set ( poll_options ) ) :
raise APIError ( ' 有重复的投票选项 ' )
if len ( poll_options ) > 8 :
raise APIError ( ' 选项过多 ' )
if max ( map ( len , poll_options ) ) > 32 :
raise APIError ( ' 选项过长 ' )
name_hash = hash_name ( username )
cw = request . form . get ( ' cw ' )
cw = cw . strip ( ) if cw else None
if not content or len ( content ) > 4096 :
abort ( 422 )
if cw and len ( cw ) > 32 :
abort ( 422 )
search_text = content . replace (
' \n ' , ' ' ) if allow_search else ' '
p = Post (
name_hash = name_hash ,
author_title = rds . hget ( RDS_KEY_TITLE , name_hash ) if use_title else None ,
name_hash = hash_name ( u . name ) ,
content = content ,
allow_search = bool ( allow_search ) ,
search_text = search_text ,
post_type = post_type ,
cw = cw or None ,
likenum = 1 ,
comments = [ ]
)
if post_type == ' text ' :
pass
elif post_type == ' image ' :
# TODO
p . file_url = ' foo bar '
else :
abort ( 422 )
db . session . add ( p )
db . session . commit ( )
tags = re . findall ( ' (^| \\ s)#([^# \\ s] { 1,32}) ' , content )
# print(tags)
for t in tags :
tag = t [ 1 ]
if not re . match ( ' \\ d+ ' , tag ) :
db . session . add ( TagRecord ( tag = tag , pid = p . id ) )
db . session . add ( Attention ( name_hash = hash_name ( user name ) , pid = p . id ) )
db . session . add ( Attention ( name_hash = hash_name ( u . name ) , pid = p . id ) )
db . session . commit ( )
if allow_search :
search_db = SearchDB ( )
search_db . insert ( content , ' post ' , p . id )
search_db . commit ( )
del search_db
rds . delete ( RDS_KEY_POLL_OPTS % p . id ) # 由于历史原因，现在的数据库里发布后删再发布可能导致id重复
if poll_options and poll_options [ 0 ] :
rds . rpush ( RDS_KEY_POLL_OPTS % p . id , * poll_options )
return {
' code ' : 0 ,
' date ' : p . id
@ -330,7 +250,7 @@ def do_post():
@app . route ( ' /_api/v1/editcw ' , methods = [ ' POST ' ] )
@limiter . limit ( " 50 / hour; 1 / 2 second " )
def edit_cw ( ) :
username = get_current_username ( )
u = get_current_user ( )
cw = request . form . get ( ' cw ' )
pid = get_num ( request . form . get ( ' pid ' ) )
@ -340,8 +260,11 @@ def edit_cw():
abort ( 422 )
post = Post . query . get_or_404 ( pid )
if post . deleted :
abort ( 451 )
if not check_can_del ( username , post . name_hash ) :
if not ( u . name in app . config . get ( ' ADMINS ' )
or hash_name ( u . name ) == post . name_hash ) :
abort ( 403 )
post . cw = cw
@ -352,19 +275,21 @@ def edit_cw():
@app . route ( ' /_api/v1/getcomment ' )
def get_comment ( ) :
username = get_current_username ( )
u = get_current_user ( )
pid = get_num ( request . args . get ( ' pid ' ) )
post = Post . query . get_or_404 ( pid )
if post . deleted and not check_can_del ( username , post . name_hash ) :
post = Post . query . get ( pid )
if not post :
abort ( 404 )
if post . deleted :
abort ( 451 )
data = map_comments ( post , user name )
data = map_comment ( post , u . name )
return {
' code ' : 0 ,
' attention ' : check_attention ( user name , pid ) ,
' attention ' : check_attention ( u . name , pid ) ,
' likenum ' : post . likenum ,
' data ' : data
}
@ -373,43 +298,38 @@ def get_comment():
@app . route ( ' /_api/v1/docomment ' , methods = [ ' POST ' ] )
@limiter . limit ( " 50 / hour; 1 / 3 second " )
def do_comment ( ) :
username = get_current_username ( )
u = get_current_user ( )
pid = get_num ( request . form . get ( ' pid ' ) )
post = Post . query . get ( pid )
if not post :
abort ( 404 )
if post . deleted and not check_can_del ( username , post . name_hash ) :
if post . deleted :
abort ( 451 )
content = request . form . get ( ' text ' , ' ' ) . strip ( )
if username . startswith ( ' tmp_ ' ) :
content = ' [tmp] \n ' + content
content = request . form . get ( ' text ' )
content = content . strip ( ) if content else None
content = ' [tmp] \n ' + content if u . name [ : 4 ] == ' tmp_ ' else content
if not content or len ( content ) > 4096 :
abort ( 422 )
use_title = request . form . get ( ' use_title ' )
name_hash = hash_name ( username )
c = Comment (
name_hash = name_hash ,
author_title = rds . hget ( RDS_KEY_TITLE , name_hash ) if use_title else None ,
name_hash = hash_name ( u . name ) ,
content = content ,
)
post . comments . append ( c )
post . comment_timestamp = c . timestamp
post . n_comments + = 1
if post . hot_score != - 1 :
post . hot_score + = 1
at = Attention . query . filter_by (
name_hash = hash_name ( user name ) , pid = pid
name_hash = hash_name ( u . name ) , pid = pid
) . first ( )
if not at :
at = Attention ( name_hash = hash_name ( user name ) , pid = pid , disabled = False )
at = Attention ( name_hash = hash_name ( u . name ) , pid = pid , disabled = False )
db . session . add ( at )
post . likenum + = 1
if post . hot_score != - 1 :
@ -421,12 +341,6 @@ def do_comment():
db . session . commit ( )
if post . allow_search :
search_db = SearchDB ( )
search_db . insert ( content , ' comment ' , c . id )
search_db . commit ( )
del search_db
return {
' code ' : 0 ,
' data ' : pid
@ -436,52 +350,51 @@ def do_comment():
@app . route ( ' /_api/v1/attention ' , methods = [ ' POST ' ] )
@limiter . limit ( " 200 / hour; 1 / second " )
def attention ( ) :
username = get_current_username ( )
if user name [ : 4 ] == ' tmp_ ' :
raise APIError ( ' 临时用户无法手动关注 ' )
u = get_current_user ( )
if u . name [ : 4 ] == ' tmp_ ' :
abort ( 403 )
s = request . form . get ( ' switch ' , type = int )
if s not in [ 0 , 1 ] :
s = request . form . get ( ' switch ' )
if s not in [ ' 0 ' , ' 1 ' ] :
abort ( 422 )
pid = request . form . get ( ' pid ' , type = int )
pid = get_num ( request . form . get ( ' pid ' ) )
post = Post . query . get_or_404 ( pid )
post = Post . query . get ( pid )
if not post :
abort ( 404 )
at = Attention . query . filter_by (
name_hash = hash_name ( user name ) , pid = pid
name_hash = hash_name ( u . name ) , pid = pid
) . first ( )
if not at :
at = Attention ( name_hash = hash_name ( user name ) , pid = pid , disabled = True )
at = Attention ( name_hash = hash_name ( u . name ) , pid = pid , disabled = True )
db . session . add ( at )
if post . hot_score != - 1 :
post . hot_score + = 2
if at . disabled == bool ( s ) :
at . disabled = not bool ( s )
post . likenum + = 2 * s - 1
if is_admin ( username ) and s :
post . is_reported = False
if ( at . disabled != ( s == ' 0 ' ) ) :
at . disabled = ( s == ' 0 ' )
post . likenum + = 1 - 2 * int ( s == ' 0 ' )
db . session . commit ( )
return {
' code ' : 0 ,
' likenum ' : post . likenum ,
' attention ' : bool ( s )
' attention ' : ( s == ' 1 ' )
}
@app . route ( ' /_api/v1/getattention ' )
def get_attention ( ) :
username = get_current_username ( )
u = get_current_user ( )
ats = Attention . query . with_entities (
Attention . pid
) . filter_by (
name_hash = hash_name ( user name ) , disabled = False
name_hash = hash_name ( u . name ) , disabled = False
) . all ( )
pids = [ pid for pid , in ats ] or [ 0 ] # sql not allow empty in
@ -492,7 +405,7 @@ def get_attention():
) . order_by ( Post . id . desc ( ) ) . all ( )
data = [
map_post ( post , user name , 10 )
map_post ( post , u . name , 10 )
for post in posts
]
@ -506,7 +419,7 @@ def get_attention():
@app . route ( ' /_api/v1/delete ' , methods = [ ' POST ' ] )
@limiter . limit ( " 50 / hour; 1 / 3 second " )
def delete ( ) :
username = get_current_username ( )
u = get_current_user ( )
obj_type = request . form . get ( ' type ' )
obj_id = get_num ( request . form . get ( ' id ' ) )
@ -515,36 +428,29 @@ def delete():
if note and len ( note ) > 100 :
abort ( 422 )
# 兼容
if obj_type == ' pid ' :
obj_type = ' post '
elif obj_type == ' cid ' :
obj_type = ' comment '
obj = None
if obj_type == ' post ' :
if obj_type == ' pid ' :
obj = Post . query . get ( obj_id )
elif obj_type == ' comment ' :
elif obj_type == ' cid ' :
obj = Comment . query . get ( obj_id )
if not obj :
abort ( 404 )
if obj . name_hash == hash_name ( user name ) :
if obj_type == ' post ' :
if obj . n_ comments:
abort ( " 已经有评论了 " )
if obj . name_hash == hash_name ( u . name ) :
if obj_type == ' pid ' :
if len ( obj . comments ) :
abort ( 403 )
Attention . query . filter_by ( pid = obj . id ) . delete ( )
TagRecord . query . filter_by ( pid = obj . id ) . delete ( )
db . session . delete ( obj )
else :
obj . deleted = True
elif username in app . config . get ( ' ADMINS ' ) :
elif u . name in app . config . get ( ' ADMINS ' ) :
obj . deleted = True
db . session . add ( Syslog (
log_type = ' ADMIN DELETE ' ,
log_detail = f " { obj_type } = { obj_id } \n { note } " ,
name_hash = hash_name ( user name )
name_hash = hash_name ( u . name )
) )
if note . startswith ( ' !ban ' ) :
db . session . add ( Syslog (
@ -555,16 +461,13 @@ def delete():
else :
abort ( 403 )
if obj_type == ' comment ' :
obj . post . n_comments - = 1
db . session . commit ( )
return { ' code ' : 0 }
@app . route ( ' /_api/v1/systemlog ' )
def system_log ( ) :
username = get_current_username ( )
u = get_current_user ( )
ss = Syslog . query . order_by ( db . desc ( ' timestamp ' ) ) . limit ( 100 ) . all ( )
@ -572,22 +475,23 @@ def system_log():
' start_time ' : app . config [ ' START_TIME ' ] ,
' salt ' : look ( app . config [ ' SALT ' ] ) ,
' tmp_token ' : tmp_token ( ) ,
' custom_title ' : rds . hget ( RDS_KEY_TITLE , hash_name ( username ) ) ,
' data ' : [ map_syslog ( s , username ) for s in ss ]
' data ' : [ map_syslog ( s , u ) for s in ss ]
}
@app . route ( ' /_api/v1/report ' , methods = [ ' POST ' ] )
@limiter . limit ( " 10 / hour; 1 / 3 second " )
def report ( ) :
username = get_current_username ( )
u = get_current_user ( )
pid = get_num ( request . form . get ( ' pid ' ) )
reason = request . form . get ( ' reason ' , ' ' )
db . session . add ( Syslog (
log_type = ' REPORT ' ,
log_detail = f " pid= { pid } \n { reason } " ,
name_hash = hash_name ( user name )
name_hash = hash_name ( u . name )
) )
post = Post . query . get ( pid )
@ -601,8 +505,9 @@ def report():
@app . route ( ' /_api/v1/update_score ' , methods = [ ' POST ' ] )
def edit_hot_score ( ) :
username = get_current_username ( )
if not is_admin ( username ) :
u = get_current_user ( )
if not is_admin ( u . name ) :
print ( u . name )
abort ( 403 )
pid = request . form . get ( ' pid ' , type = int )
@ -615,90 +520,5 @@ def edit_hot_score():
return { ' code ' : 0 }
@app . route ( ' /_api/v1/vote ' , methods = [ ' POST ' ] )
@limiter . limit ( " 100 / hour; 1 / 2 second " )
def add_vote ( ) :
username = get_current_username ( )
username = name_with_tmp_limit ( username )
pid = request . form . get ( ' pid ' , type = int )
vote = request . form . get ( ' vote ' )
if not rds . exists ( RDS_KEY_POLL_OPTS % pid ) :
abort ( 404 )
opts = rds . lrange ( RDS_KEY_POLL_OPTS % pid , 0 , - 1 )
for idx , opt in enumerate ( opts ) :
if rds . sismember ( RDS_KEY_POLL_VOTES % ( pid , idx ) , hash_name ( username ) ) :
raise APIError ( ' 已经投过票了 ' )
if vote not in opts :
raise APIError ( ' 无效的选项 ' )
rds . sadd ( RDS_KEY_POLL_VOTES % ( pid , opts . index ( vote ) ) , hash_name ( username ) )
return {
' code ' : 0 ,
' data ' : gen_poll_dict ( pid , username )
}
@app . route ( ' /_api/v1/block ' , methods = [ ' POST ' ] )
@limiter . limit ( " 15 / hour; 1 / 2 second " )
def block_user_by_target ( ) :
username = get_current_username ( )
target_type = request . form . get ( ' type ' )
target_id = request . form . get ( ' id ' , type = int )
if username . startswith ( ' tmp_ ' ) :
raise APIError ( ' 临时用户无法拉黑 ' )
if target_type == ' post ' :
target = Post . query . get_or_404 ( target_id )
elif target_type == ' comment ' :
target = Comment . query . get_or_404 ( target_id )
else :
raise APIError ( ' 无效的type ' )
if hash_name ( username ) == target . name_hash :
raise APIError ( ' 不可拉黑自己 ' )
if is_admin ( username ) :
rds . sadd ( RDS_KEY_DANGEROUS_USERS , target . name_hash )
curr_cnt = rds . hget ( RDS_KEY_BLOCKED_COUNT , target . name_hash )
else :
if rds . sismember ( RDS_KEY_BLOCK_SET % username , target . name_hash ) :
raise APIError ( ' 已经拉黑了 ' )
rds . sadd ( RDS_KEY_BLOCK_SET % username , target . name_hash )
curr_cnt = rds . hincrby ( RDS_KEY_BLOCKED_COUNT , target . name_hash , 1 )
if curr_cnt > = DANGEROUS_USER_THRESHOLD :
rds . sadd ( RDS_KEY_DANGEROUS_USERS , target . name_hash )
return {
' code ' : 0 ,
' data ' : {
' curr ' : curr_cnt ,
' threshold ' : DANGEROUS_USER_THRESHOLD
}
}
@app . route ( ' /_api/v1/title ' , methods = [ ' POST ' ] )
@limiter . limit ( " 10 / hour; 1 / 2 second " )
def set_title ( ) :
username = get_current_username ( )
title = request . form . get ( ' title ' )
if not title :
rds . hdel ( RDS_KEY_TITLE , hash_name ( username ) )
else :
if len ( title ) > 10 :
raise APIError ( ' 自定义头衔太长 ' )
if title in rds . hvals ( RDS_KEY_TITLE ) : # 如果未来量大还是另外用个set维护
raise APIError ( ' 已经被使用了 ' )
rds . hset ( RDS_KEY_TITLE , hash_name ( username ) , title )
return { ' code ' : 0 }
if __name__ == ' __main__ ' :
app . run ( debug = True )
