73 lines
2.3 KiB
Python
73 lines
2.3 KiB
Python
"""Kullanıcı talepleri: gönderim (herkes) + admin gelen kutusu."""
|
||
from flask import Blueprint, abort, flash, redirect, render_template, request, session, url_for
|
||
|
||
import security
|
||
from db import get_db
|
||
|
||
request_bp = Blueprint("talepler", __name__)
|
||
|
||
SUBJECT_MAX = 150
|
||
BODY_MAX = 5000
|
||
NAME_MAX = 100
|
||
|
||
|
||
@request_bp.get("/talep")
|
||
def new_talep():
|
||
return render_template(
|
||
"new_talep.html",
|
||
prefill_name=session.get("name", ""),
|
||
prefill_email=session.get("email", ""),
|
||
)
|
||
|
||
|
||
@request_bp.post("/talep")
|
||
@security.rate_limited("talep", 6, 900)
|
||
def do_talep():
|
||
sender_name = security.clean_text(request.form.get("sender_name"), NAME_MAX)
|
||
sender_email = security.validate_email(request.form.get("sender_email"))
|
||
subject = security.clean_text(request.form.get("subject"), SUBJECT_MAX)
|
||
body = security.clean_multiline(request.form.get("body"), BODY_MAX)
|
||
|
||
if not sender_name:
|
||
flash("Adınızı yazmalısınız.", "error")
|
||
return redirect(url_for("talepler.new_talep"))
|
||
if sender_email is None:
|
||
flash("Geçerli bir e-posta adresi girin.", "error")
|
||
return redirect(url_for("talepler.new_talep"))
|
||
if not subject:
|
||
flash("Talep başlığı zorunlu.", "error")
|
||
return redirect(url_for("talepler.new_talep"))
|
||
if not body:
|
||
flash("Talep açıklaması boş olamaz.", "error")
|
||
return redirect(url_for("talepler.new_talep"))
|
||
|
||
db = get_db()
|
||
db.execute(
|
||
"INSERT INTO requests (sender_name, sender_email, subject, body) VALUES (?, ?, ?, ?)",
|
||
(sender_name, sender_email, subject, body),
|
||
)
|
||
db.commit()
|
||
flash("Talebiniz iletildi. Teşekkürler!", "success")
|
||
return redirect(url_for("index"))
|
||
|
||
|
||
@request_bp.get("/admin/talepler")
|
||
def admin_inbox():
|
||
if session.get("role") != "admin":
|
||
abort(403)
|
||
db = get_db()
|
||
requests = db.execute(
|
||
"SELECT * FROM requests ORDER BY created_at DESC"
|
||
).fetchall()
|
||
return render_template("admin/requests.html", requests=requests)
|
||
|
||
|
||
@request_bp.post("/admin/talepler/<int:rid>/sil")
|
||
def admin_delete(rid):
|
||
if session.get("role") != "admin":
|
||
abort(403)
|
||
db = get_db()
|
||
db.execute("DELETE FROM requests WHERE id = ?", (rid,))
|
||
db.commit()
|
||
flash("Talep silindi.", "info")
|
||
return redirect(url_for("talepler.admin_inbox")) |