From 7e80adad5621013e5840ac43281cff149fa15842 Mon Sep 17 00:00:00 2001
From: rubenwardy <rw@rubenwardy.com>
Date: Tue, 29 May 2018 17:15:53 +0100
Subject: [PATCH] Fix soft deleted and unapproved packages appearing where they
 shouldn't

---
 app/models.py                              | 2 +-
 app/templates/meta/view.html               | 2 +-
 app/templates/users/user_profile_page.html | 2 +-
 app/views/users.py                         | 6 +++++-
 4 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/app/models.py b/app/models.py
index 9db01f2..fbd8bad 100644
--- a/app/models.py
+++ b/app/models.py
@@ -336,7 +336,7 @@ class Package(db.Model):
 	forums       = db.Column(db.Integer,     nullable=True)
 
 	provides = db.relationship("MetaPackage", secondary=provides, lazy="subquery",
-			backref=db.backref("packages", lazy=True))
+			backref=db.backref("packages", lazy="dynamic"))
 
 	dependencies = db.relationship("Dependency", backref="depender", lazy="dynamic", foreign_keys=[Dependency.depender_id])
 
diff --git a/app/templates/meta/view.html b/app/templates/meta/view.html
index c5473b9..7745ea9 100644
--- a/app/templates/meta/view.html
+++ b/app/templates/meta/view.html
@@ -8,5 +8,5 @@ Packages providing '{{ mpackage.name }}''
 	<h1>Packages providing '{{ mpackage.name }}''</h1>
 
 	{% from "macros/packagegridtile.html" import render_pkggrid %}
-	{{ render_pkggrid(mpackage.packages) }}
+	{{ render_pkggrid(mpackage.packages.filter_by(approved=True, soft_deleted=False).all()) }}
 {% endblock %}
diff --git a/app/templates/users/user_profile_page.html b/app/templates/users/user_profile_page.html
index f1ee6b5..062e9e8 100644
--- a/app/templates/users/user_profile_page.html
+++ b/app/templates/users/user_profile_page.html
@@ -49,7 +49,7 @@
 	<h2>Packages</h2>
 	<div class="box-body">
 		<ul>
-			{% for p in user.packages %}
+			{% for p in packages %}
 				<li><a href="{{ p.getDetailsURL() }}">
 					{{ p.title }} by {{ p.author.display_name }}
 				</a></li>
diff --git a/app/views/users.py b/app/views/users.py
index 62bc6f2..b68c103 100644
--- a/app/views/users.py
+++ b/app/views/users.py
@@ -49,6 +49,10 @@ def user_profile_page(username):
 	if not user:
 		abort(404)
 
+	packages = user.packages.filter_by(soft_deleted=False)
+	if not current_user.is_authenticated or (user != current_user and not current_user.canAccessTodoList()):
+		packages = packages.filter_by(approved=True)
+
 	form = None
 	if user.checkPerm(current_user, Permission.CHANGE_DNAME) or \
 			user.checkPerm(current_user, Permission.CHANGE_EMAIL) or \
@@ -92,7 +96,7 @@ def user_profile_page(username):
 
 	# Process GET or invalid POST
 	return render_template("users/user_profile_page.html",
-			user=user, form=form)
+			user=user, form=form, packages=packages)
 
 
 @app.route("/users/claim/", methods=["GET", "POST"])