Merge branch 'main' into show-2fa-code

bookwyrm/views/__init__.py

@@ -10,7 +10,7 @@ from .admin.federation import Federation, FederatedServer
 from .admin.federation import AddFederatedServer, ImportServerBlocklist
 from .admin.federation import block_server, unblock_server, refresh_server
 from .admin.email_blocklist import EmailBlocklist
-from .admin.imports import ImportList
+from .admin.imports import ImportList, disable_imports, enable_imports
 from .admin.ip_blocklist import IPBlocklist
 from .admin.invite import ManageInvites, Invite, InviteRequest
 from .admin.invite import ManageInviteRequests, ignore_invite_request

bookwyrm/views/admin/imports.py

@@ -5,6 +5,7 @@ from django.shortcuts import get_object_or_404, redirect
 from django.template.response import TemplateResponse
 from django.utils.decorators import method_decorator
 from django.views import View
+from django.views.decorators.http import require_POST
 
 from bookwyrm import models
 from bookwyrm.settings import PAGE_LENGTH
@@ -53,3 +54,25 @@ class ImportList(View):
         import_job = get_object_or_404(models.ImportJob, id=import_id)
         import_job.stop_job()
         return redirect("settings-imports")
+
+
+@require_POST
+@permission_required("bookwyrm.edit_instance_settings", raise_exception=True)
+# pylint: disable=unused-argument
+def disable_imports(request):
+    """When you just need people to please stop starting imports"""
+    site = models.SiteSettings.objects.get()
+    site.imports_enabled = False
+    site.save(update_fields=["imports_enabled"])
+    return redirect("settings-imports")
+
+
+@require_POST
+@permission_required("bookwyrm.edit_instance_settings", raise_exception=True)
+# pylint: disable=unused-argument
+def enable_imports(request):
+    """When you just need people to please stop starting imports"""
+    site = models.SiteSettings.objects.get()
+    site.imports_enabled = True
+    site.save(update_fields=["imports_enabled"])
+    return redirect("settings-imports")

bookwyrm/views/admin/invite.py

@@ -85,6 +85,11 @@ class Invite(View):
     # post handling is in views.register.Register
 
 
+@method_decorator(login_required, name="dispatch")
+@method_decorator(
+    permission_required("bookwyrm.create_invites", raise_exception=True),
+    name="dispatch",
+)
 class ManageInviteRequests(View):
     """grant invites like the benevolent lord you are"""
 
@@ -177,6 +182,7 @@ class InviteRequest(View):
 
 
 @require_POST
+@permission_required("bookwyrm.create_invites", raise_exception=True)
 def ignore_invite_request(request):
     """hide an invite request"""
     invite_request = get_object_or_404(

bookwyrm/views/imports/import_data.py

@@ -4,6 +4,7 @@ import datetime
 
 from django.contrib.auth.decorators import login_required
 from django.db.models import Avg, ExpressionWrapper, F, fields
+from django.core.exceptions import PermissionDenied
 from django.core.paginator import Paginator
 from django.http import HttpResponseBadRequest
 from django.shortcuts import redirect
@@ -54,6 +55,10 @@ class Import(View):
 
     def post(self, request):
         """ingest a goodreads csv"""
+        site = models.SiteSettings.objects.get()
+        if not site.imports_enabled:
+            raise PermissionDenied()
+
         form = forms.ImportForm(request.POST, request.FILES)
         if not form.is_valid():
             return HttpResponseBadRequest()