From 3854a877bfaa129293fa605a5e722680f3b2dfc1 Mon Sep 17 00:00:00 2001 From: evilchili Date: Sat, 4 Oct 2025 09:00:50 -0700 Subject: [PATCH] only allow page creation if parent exists --- src/ttfrog/web.py | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/src/ttfrog/web.py b/src/ttfrog/web.py index 9f6f509..42acfc4 100644 --- a/src/ttfrog/web.py +++ b/src/ttfrog/web.py @@ -16,7 +16,7 @@ def relative_uri(path: str = ""): def get_parent(table: str, uri: str): try: - parent_uri = uri.strip("/").split("/", -1)[0] + parent_uri = uri.strip("/").rsplit("/", 1)[0] except IndexError: return None @@ -84,7 +84,8 @@ def index(): @app.web.route(f"{app.config.VIEW_URI}//", methods=["GET"]) @app.web.route(f"{app.config.VIEW_URI}/", methods=["GET"], defaults={'table': 'Page'}) def view(table, path): - return rendered(get_page(request.path, table=table, create_okay=True)) + parent = get_parent(table, relative_uri()) + return rendered(get_page(request.path, table=table, create_okay=parent.doc_id is not None)) @app.web.route(f"{app.config.VIEW_URI}//", methods=["POST"]) @@ -93,7 +94,7 @@ def edit(table, path): uri = relative_uri() parent = get_parent(table, uri) if not parent: - return Response(f"Parent for {uri} does not exist.", status=403) + return Response("You cannot create a page at this location.", status=403) # get or create the docoument at this uri page = get_page(uri, table=table, create_okay=True)