Commit ab009de5 authored by berumuron's avatar berumuron
Browse files

fix: Disable access to event creation to visitors

parent a70443ee
import functools
from flask import (
Blueprint,
request,
......@@ -15,6 +17,18 @@ from .models import User
bp = Blueprint("auth", __name__, url_prefix="/auth")
def login_required(view):
"""A decorator to require user to be logged in on certain views."""
@functools.wraps(view)
def wrapped_view(**kwargs):
if g.current_user is None:
return redirect(url_for("auth.login"))
return view(**kwargs)
return wrapped_view
@bp.before_app_request
def load_logged_in_user():
"""Set the global current_user if logged in."""
......
from flask import Blueprint, request, redirect, url_for, flash, render_template
from .auth import login_required
from .models import Event
......@@ -7,6 +8,7 @@ bp = Blueprint("events", __name__, url_prefix="/events")
@bp.route("/create", methods=("GET", "POST"))
@login_required
def create():
if request.method == "POST":
title = request.form["title"].strip()
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment