Merge branch 'main' into progress_update

bookwyrm/views/authentication.py

@@ -32,7 +32,14 @@ class Login(View):
         login_form = forms.LoginForm(request.POST)
 
         localname = login_form.data['localname']
-        username = '%s@%s' % (localname, DOMAIN)
+        if '@' in localname: # looks like an email address to me
+            email = localname
+            try:
+                username = models.User.objects.get(email=email)
+            except models.User.DoesNotExist: # maybe it's a full username?
+                username = localname
+        else:
+            username = '%s@%s' % (localname, DOMAIN)
         password = login_form.data['password']
         user = authenticate(request, username=username, password=password)
         if user is not None:

bookwyrm/views/helpers.py

@@ -36,6 +36,8 @@ def is_bookworm_request(request):
 
 def object_visible_to_user(viewer, obj):
     ''' is a user authorized to view an object? '''
+    if not obj:
+        return False
     if viewer == obj.user or obj.privacy in ['public', 'unlisted']:
         return True
     if obj.privacy == 'followers' and \

bookwyrm/views/shelf.py

@@ -65,12 +65,13 @@ class Shelf(View):
         return TemplateResponse(request, 'shelf.html', data)
 
     @method_decorator(login_required, name='dispatch')
-    def post(self, request, username, shelf_id):
-        ''' user generated shelves '''
-        if not request.user.username == username:
-            return HttpResponseBadRequest()
+    def post(self, request, username, shelf_identifier):
+        ''' edit a shelf '''
+        try:
+            shelf = request.user.shelf_set.get(identifier=shelf_identifier)
+        except models.Shelf.DoesNotExist:
+            return HttpResponseNotFound()
 
-        shelf = get_object_or_404(models.Shelf, id=shelf_id)
         if request.user != shelf.user:
             return HttpResponseBadRequest()
         if not shelf.editable and request.POST.get('name') != shelf.name:

bookwyrm/views/status.py

@@ -21,12 +21,13 @@ from .helpers import is_api_request, is_bookworm_request, object_visible_to_user
 
 # pylint: disable= no-self-use
 class Status(View):
-    ''' the view for *posting* '''
+    ''' get posting '''
     def get(self, request, username, status_id):
         ''' display a particular status (and replies, etc) '''
         try:
             user = get_user_from_username(username)
-            status = models.Status.objects.select_subclasses().get(id=status_id)
+            status = models.Status.objects.select_subclasses().get(
+                id=status_id, deleted=False)
         except ValueError:
             return HttpResponseNotFound()
 
@@ -51,10 +52,11 @@ class Status(View):
 
 @method_decorator(login_required, name='dispatch')
 class CreateStatus(View):
-    ''' get posting '''
+    ''' the view for *posting* '''
     def post(self, request, status_type):
         ''' create  status of whatever type '''
         status_type = status_type[0].upper() + status_type[1:]
+
         try:
             form = getattr(forms, '%sForm' % status_type)(request.POST)
         except AttributeError:

bookwyrm/views/user.py

@@ -185,4 +185,4 @@ class EditUser(View):
         user.save()
 
         broadcast(user, user.to_update_activity(user))
-        return redirect('/user/%s' % request.user.localname)
+        return redirect(user.local_path)