[UPDATE] Update pillow requirement

Updates the requirements on [pillow](https://github.com/python-pillow/Pillow) to permit the latest version. - [Release notes](https://github.com/python-pillow/Pillow/releases) - [Changelog](https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst) - [Commits](https://github.com/python-pillow/Pillow/compare/11.1.0...12.0.0) --- updated-dependencies: - dependency-name: pillow dependency-version: 12.0.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
2025-11-02 10:03:05 +00:00 · 2025-10-20 08:19:35 +00:00
9 changed files with 196 additions and 147 deletions
--- a/club/views.py
+++ b/club/views.py
@@ -59,7 +59,7 @@ from com.views import (
    PosterEditBaseView,
    PosterListBaseView,
 )
-from core.auth.mixins import CanEditMixin, PermissionOrClubBoardRequiredMixin
+from core.auth.mixins import CanEditMixin
 from core.models import PageRev
 from core.views import DetailFormView, PageEditViewBase, UseFragmentsMixin
 from core.views.mixins import FragmentMixin, FragmentRenderer, TabedViewMixin
@@ -758,13 +758,11 @@ class MailingAutoGenerationView(View):
        return redirect("club:mailing", club_id=club.id)


-class PosterListView(
-    PermissionOrClubBoardRequiredMixin, ClubTabsMixin, PosterListBaseView
-):
+class PosterListView(ClubTabsMixin, PosterListBaseView):
    """List communication posters."""

    current_tab = "posters"
-    permission_required = "com.view_poster"
+    extra_context = {"app": "club"}

    def get_queryset(self):
        return super().get_queryset().filter(club=self.club.id)
@@ -772,17 +770,6 @@ class PosterListView(
    def get_object(self):
        return self.club

-    def get_context_data(self, **kwargs):
-        return super().get_context_data(**kwargs) | {
-            "create_url": reverse_lazy(
-                "club:poster_create", kwargs={"club_id": self.club.id}
-            ),
-            "get_edit_url": lambda poster: reverse(
-                "club:poster_edit",
-                kwargs={"club_id": self.club.id, "poster_id": poster.id},
-            ),
-        }
-

 class PosterCreateView(ClubTabsMixin, PosterCreateBaseView):
    """Create communication poster."""
--- a/com/models.py
+++ b/com/models.py
@@ -402,7 +402,9 @@ class Poster(models.Model):
                groups__id__in=[settings.SITH_GROUP_COM_ADMIN_ID]
            ):
                Notification.objects.create(
-                    user=user, url=reverse("com:poster_list"), type="POSTER_MODERATION"
+                    user=user,
+                    url=reverse("com:poster_moderate_list"),
+                    type="POSTER_MODERATION",
                )
        return super().save(*args, **kwargs)

--- a/com/static/com/css/posters.scss
+++ b/com/static/com/css/posters.scss
@@ -20,7 +20,33 @@
      position: absolute;
      display: flex;
      bottom: 5px;
-      left: 0;
+
+      &.left {
+        left: 0;
+      }
+
+      &.right {
+        right: 0;
+      }
+
+      .link {
+        padding: 5px;
+        padding-left: 20px;
+        padding-right: 20px;
+        margin-left: 5px;
+        border-radius: 20px;
+        background-color: hsl(40, 100%, 50%);
+        color: black;
+
+        &:hover {
+          color: black;
+          background-color: hsl(40, 58%, 50%);
+        }
+
+        &.delete {
+          background-color: hsl(0, 100%, 40%);
+        }
+      }
    }
  }

@@ -117,15 +143,43 @@
        }
      }

-      .actions {
-        display: flex;
-        flex-direction: column;
-        align-items: stretch;
-        form {
-          margin: unset;
-          padding: unset;
-          button {
-            width: 100%;
+      .edit,
+      .moderate,
+      .slideshow {
+        padding: 5px;
+        border-radius: 20px;
+        background-color: hsl(40, 100%, 50%);
+        color: black;
+
+        &:hover {
+          color: black;
+          background-color: hsl(40, 58%, 50%);
+        }
+
+        &:nth-child(2n) {
+          margin-top: 5px;
+          margin-bottom: 5px;
+        }
+      }
+
+      .tooltip {
+        visibility: hidden;
+        width: 120px;
+        background-color: hsl(210, 20%, 98%);
+        color: hsl(0, 0%, 0%);
+        text-align: center;
+        padding: 5px 0;
+        border-radius: 6px;
+        position: absolute;
+        z-index: 10;
+
+        ul {
+          margin-left: 0;
+          display: inline-block;
+
+          li {
+            display: list-item;
+            list-style-type: none;
          }
        }
      }
--- a/com/templates/com/poster_list.jinja
+++ b/com/templates/com/poster_list.jinja
@@ -13,53 +13,53 @@

    <div id="title">
      <h3>{% trans %}Posters{% endtrans %}</h3>
-      <div id="links">
-        <a id="create" class="btn btn-blue" href="{{ create_url }}">
-          <i class="fa fa-plus"></i>
-          {% trans %}Create{% endtrans %}
-        </a>
+      <div id="links" class="right">
+        {% if app == "com" %}
+          <a id="create" class="link" href="{{ url(app + ":poster_create") }}">{% trans %}Create{% endtrans %}</a>
+          <a id="moderation" class="link" href="{{ url("com:poster_moderate_list") }}">{% trans %}Moderation{% endtrans %}</a>
+        {% elif app == "club" %}
+          <a id="create" class="link" href="{{ url(app + ":poster_create", club.id) }}">{% trans %}Create{% endtrans %}</a>
+        {% endif %}
      </div>
    </div>

    <div id="posters">
-      {% for poster in poster_list %}
-        <div class="poster{% if not poster.is_moderated %} not_moderated{% endif %}">
-          <div class="name">{{ poster.name }}</div>
-          <div
-            class="image"
-            hover="{% trans %}Click to expand{% endtrans %}"
-            @click="active = $el.firstElementChild"
-            tooltip="{%- for screen in poster.screens.all() -%}
-                       {{ screen }}
-                     {% endfor %}"
-          >
-            <img src="{{ poster.file.url }}" alt="{{ poster.name }}">
-          </div>
-          <div class="dates">
-            <div class="begin">{{ poster.date_begin | localtime | date("d/M/Y H:m") }}</div>
-            <div class="end">{{ poster.date_end | localtime | date("d/M/Y H:m") }}</div>
-          </div>
-          <div class="actions">
-            {% if poster.is_editable %}
-              <a class="btn btn-blue" href="{{ get_edit_url(poster) }}">
-                <i class="fa fa-pen-to-square"></i>
-                {% trans %}Edit{% endtrans %}
-              </a>
-            {% endif %}
-            {% if not poster.is_moderated and user.has_perm("com.moderate_poster") %}
-              <form action="{{ url("com:poster_moderate", object_id=poster.id) }}" method="post">
-                {% csrf_token %}
-                <button type="submit" class="btn btn-green">
-                  <i class="fa fa-check"></i>
-                  {% trans %}Moderate{% endtrans %}
-                </button>
-              </form>
-            {% endif %}
-          </div>
-        </div>
-      {% else %}
+
+      {% if poster_list.count() == 0 %}
        <div id="no-posters">{% trans %}No posters{% endtrans %}</div>
-      {% endfor %}
+      {% else %}
+
+        {% for poster in poster_list %}
+          <div class="poster{% if not poster.is_moderated %} not_moderated{% endif %}">
+            <div class="name">{{ poster.name }}</div>
+            <div
+              class="image"
+              hover="{% trans %}Click to expand{% endtrans %}"
+              @click="active = $el.firstElementChild"
+            >
+              <img src="{{ poster.file.url }}"></img>
+            </div>
+            <div class="dates">
+              <div class="begin">{{ poster.date_begin | localtime | date("d/M/Y H:m") }}</div>
+              <div class="end">{{ poster.date_end | localtime | date("d/M/Y H:m") }}</div>
+            </div>
+            {% if app == "com" %}
+              <a class="edit" href="{{ url(app + ":poster_edit", poster.id) }}">{% trans %}Edit{% endtrans %}</a>
+            {% elif app == "club" %}
+              <a class="edit" href="{{ url(app + ":poster_edit", club.id, poster.id) }}">{% trans %}Edit{% endtrans %}</a>
+            {% endif %}
+            <div class="tooltip">
+              <ul>
+                {% for screen in poster.screens.all() %}
+                  <li>{{ screen }}</li>
+                {% endfor %}
+              </ul>
+            </div>
+          </div>
+        {% endfor %}
+
+      {% endif %}
+
    </div>

    <div
@@ -68,9 +68,7 @@
      @click="active = null"
      :class="{active: active !== null}"
    >
-      <div id="placeholder">
-        <img :src="active?.src" :alt="active?.name">
-      </div>
+      <div id="placeholder"><img :src="active?.src"></div>
    </div>

  </div>
--- a/com/templates/com/poster_moderate.jinja
+++ b/com/templates/com/poster_moderate.jinja
@@ -0,0 +1,43 @@
+{% extends "core/base.jinja" %}
+
+{% block script %}
+  {{ super() }}
+  <script src="{{ static('com/js/poster_list.js') }}"></script>
+{% endblock %}
+
+{% block additional_css %}
+  <link rel="stylesheet" href="{{ static('com/css/posters.scss') }}">
+{% endblock %}
+
+{% block content %}
+  <div id="poster_list">
+
+    <div id="title">
+      <div id="links" class="left">
+        <a id="list" class="link" href="{{ url("com:poster_list") }}">{% trans %}List{% endtrans %}</a>
+      </div>
+      <h3>{% trans %}Posters - moderation{% endtrans %}</h3>
+    </div>
+
+    <div id="posters">
+
+      {% if object_list.count == 0 %}
+        <div id="no-posters">{% trans %}No objects{% endtrans %}</div>
+      {% else %}
+
+        {% for poster in object_list %}
+          <div class="poster{% if not poster.is_moderated %} not_moderated{% endif %}">
+            <div class="name"> {{ poster.name }} </div>
+            <div class="image"> <img src="{{ poster.file.url }}"></img> </div>
+            <a class="moderate" href="{{ url("com:poster_moderate", object_id=poster.id) }}">Moderate</a>
+          </div>
+        {% endfor %}
+
+      {% endif %}
+
+    </div>
+
+    <div id="view"><div id="placeholder"></div></div>
+
+  </div>
+{% endblock %}
--- a/com/tests/test_views.py
+++ b/com/tests/test_views.py
@@ -17,9 +17,7 @@ from unittest.mock import patch

 import pytest
 from django.conf import settings
-from django.contrib.auth.models import Permission
 from django.contrib.sites.models import Site
-from django.core.files.uploadedfile import SimpleUploadedFile
 from django.test import Client, TestCase
 from django.urls import reverse
 from django.utils import html
@@ -29,10 +27,9 @@ from model_bakery import baker
 from pytest_django.asserts import assertNumQueries, assertRedirects

 from club.models import Club, Membership
-from com.models import News, NewsDate, Poster, Sith, Weekmail, WeekmailArticle
+from com.models import News, NewsDate, Sith, Weekmail, WeekmailArticle
 from core.baker_recipes import subscriber_user
 from core.models import AnonymousUser, Group, User
-from core.utils import RED_PIXEL_PNG


@pytest.fixture()
@@ -317,6 +314,7 @@ def test_feed(client: Client):
    [
        reverse("com:poster_list"),
        reverse("com:poster_create"),
+        reverse("com:poster_moderate_list"),
    ],
 )
 def test_poster_management_views_crash_test(client: Client, url: str):
@@ -327,37 +325,3 @@ def test_poster_management_views_crash_test(client: Client, url: str):
    client.force_login(user)
    res = client.get(url)
    assert res.status_code == 200
-
-
-@pytest.mark.django_db
-@pytest.mark.parametrize(
-    "referer",
-    [
-        None,
-        reverse("com:poster_list"),
-        reverse("club:poster_list", kwargs={"club_id": settings.SITH_MAIN_CLUB_ID}),
-    ],
-)
-def test_moderate_poster(client: Client, referer: str | None):
-    poster = baker.make(
-        Poster,
-        is_moderated=False,
-        file=SimpleUploadedFile("test.png", content=RED_PIXEL_PNG),
-        club_id=settings.SITH_MAIN_CLUB_ID,
-    )
-    user = baker.make(
-        User,
-        user_permissions=Permission.objects.filter(
-            codename__in=["view_poster", "moderate_poster"]
-        ),
-    )
-    client.force_login(user)
-    headers = {"REFERER": f"https://{settings.SITH_URL}{referer}"} if referer else {}
-    response = client.post(
-        reverse("com:poster_moderate", kwargs={"object_id": poster.id}), headers=headers
-    )
-    result_url = referer or reverse("com:poster_list")
-    assertRedirects(response, result_url)
-    poster.refresh_from_db()
-    assert poster.is_moderated
-    assert poster.moderator == user
--- a/com/urls.py
+++ b/com/urls.py
@@ -33,6 +33,7 @@ from com.views import (
    PosterDeleteView,
    PosterEditView,
    PosterListView,
+    PosterModerateListView,
    PosterModerateView,
    ScreenCreateView,
    ScreenDeleteView,
@@ -101,6 +102,11 @@ urlpatterns = [
        PosterDeleteView.as_view(),
        name="poster_delete",
    ),
+    path(
+        "poster/moderate/",
+        PosterModerateListView.as_view(),
+        name="poster_moderate_list",
+    ),
    path(
        "poster/<int:object_id>/moderate/",
        PosterModerateView.as_view(),
--- a/com/views.py
+++ b/com/views.py
@@ -25,7 +25,6 @@ import itertools
 from datetime import date, timedelta
 from smtplib import SMTPRecipientsRefused
 from typing import Any
-from urllib.parse import urlparse

 from dateutil.relativedelta import relativedelta
 from django.conf import settings
@@ -35,7 +34,7 @@ from django.contrib.auth.mixins import (
 )
 from django.contrib.syndication.views import Feed
 from django.core.exceptions import PermissionDenied, ValidationError
-from django.db.models import Exists, Max, OuterRef, Value
+from django.db.models import Max
 from django.forms.models import modelform_factory
 from django.http import HttpResponseRedirect
 from django.shortcuts import get_object_or_404, redirect
@@ -46,7 +45,7 @@ from django.utils.translation import gettext_lazy as _
 from django.views.generic import DetailView, ListView, TemplateView, View
 from django.views.generic.edit import CreateView, DeleteView, UpdateView

-from club.models import Club, Mailing, Membership
+from club.models import Club, Mailing
 from com.forms import NewsDateForm, NewsForm, PosterForm
 from com.ics_calendar import IcsCalendar
 from com.models import News, NewsDate, Poster, Screen, Sith, Weekmail, WeekmailArticle
@@ -562,26 +561,16 @@ class MailingModerateView(View):
        raise PermissionDenied


-class PosterListBaseView(ListView):
+class PosterListBaseView(PermissionOrClubBoardRequiredMixin, ListView):
    """List communication posters."""

    model = Poster
    template_name = "com/poster_list.jinja"
    permission_required = "com.view_poster"
+    ordering = ["-date_begin"]

-    def get_queryset(self):
-        qs = Poster.objects.prefetch_related("screens")
-        if self.request.user.has_perm("com.edit_poster"):
-            qs = qs.annotate(is_editable=Value(value=True))
-        else:
-            qs = qs.annotate(
-                is_editable=Exists(
-                    Membership.objects.ongoing()
-                    .board()
-                    .filter(user=self.request.user, club=OuterRef("club_id"))
-                )
-            )
-        return qs.order_by("-date_begin")
+    def get_context_data(self, **kwargs):
+        return super().get_context_data(**kwargs) | {"club": self.club}


 class PosterCreateBaseView(PermissionOrClubBoardRequiredMixin, CreateView):
@@ -644,17 +633,21 @@ class PosterDeleteBaseView(
    permission_required = "com.delete_poster"


-class PosterListView(PermissionRequiredMixin, ComTabsMixin, PosterListBaseView):
+class PosterListView(ComTabsMixin, PosterListBaseView):
    """List communication posters."""

    current_tab = "posters"
-    extra_context = {
-        "create_url": reverse_lazy("com:poster_create"),
-        "get_edit_url": lambda poster: reverse(
-            "com:poster_edit", kwargs={"poster_id": poster.id}
-        ),
-    }
-    permission_required = "com.view_poster"
+
+    def get_queryset(self):
+        qs = super().get_queryset()
+        if self.request.user.has_perm("com.view_poster"):
+            return qs
+        return qs.filter(club=self.club.id)
+
+    def get_context_data(self, **kwargs):
+        kwargs = super().get_context_data(**kwargs)
+        kwargs["app"] = "com"
+        return kwargs


 class PosterCreateView(ComTabsMixin, PosterCreateBaseView):
@@ -679,6 +672,17 @@ class PosterDeleteView(PosterDeleteBaseView):
    success_url = reverse_lazy("com:poster_list")


+class PosterModerateListView(PermissionRequiredMixin, ComTabsMixin, ListView):
+    """Moderate list communication poster."""
+
+    current_tab = "posters"
+    model = Poster
+    template_name = "com/poster_moderate.jinja"
+    queryset = Poster.objects.filter(is_moderated=False).all()
+    permission_required = "com.moderate_poster"
+    extra_context = {"app": "com"}
+
+
 class PosterModerateView(PermissionRequiredMixin, ComTabsMixin, View):
    """Moderate communication poster."""

@@ -686,21 +690,12 @@ class PosterModerateView(PermissionRequiredMixin, ComTabsMixin, View):
    permission_required = "com.moderate_poster"
    extra_context = {"app": "com"}

-    def post(self, request, *args, **kwargs):
+    def get(self, request, *args, **kwargs):
        obj = get_object_or_404(Poster, pk=kwargs["object_id"])
        obj.is_moderated = True
        obj.moderator = request.user
        obj.save()
-        # The moderation request may be originated from a club context (/club/poster)
-        # or a global context (/com/poster),
-        # so the redirection URL will be the URL of the page that called this view,
-        # as long as the latter belongs to the sith.
-        referer = self.request.META.get("HTTP_REFERER")
-        if referer:
-            parsed = urlparse(referer)
-            if parsed.netloc == settings.SITH_URL:
-                return redirect(parsed.path)
-        return redirect(reverse("com:poster_list"))
+        return redirect("com:poster_moderate_list")


 class ScreenListView(PermissionRequiredMixin, ComTabsMixin, ListView):
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -22,7 +22,7 @@ dependencies = [
    "django>=5.2.1,<6.0.0",
    "django-ninja<2.0.0,>=1.4.0",
    "django-ninja-extra<1.0.0,>=0.22.9",
-    "Pillow<12.0.0,>=11.1.0",
+    "Pillow>=11.1.0,<13.0.0",
    "mistune<4.0.0,>=3.1.3",
    "django-jinja<3.0.0,>=2.11.0",
    "cryptography>=45.0.3,<46.0.0",