Limit visibility of unapproved packages to maintainers and approvers

Fixes #338

app/blueprints/packages/packages.py

@@ -115,6 +115,9 @@ def getReleases(package):
 @bp.route("/packages/<author>/<name>/")
 @is_package_page
 def view(package):
+	if not package.checkPerm(current_user, Permission.SEE_PACKAGE):
+		abort(404)
+
 	show_similar = not package.approved and (
 			current_user in package.maintainers or
 				package.checkPerm(current_user, Permission.APPROVE_NEW))
@@ -205,6 +208,9 @@ def shield(package, type):
 @bp.route("/packages/<author>/<name>/download/")
 @is_package_page
 def download(package):
+	if not package.checkPerm(current_user, Permission.SEE_PACKAGE):
+		abort(404)
+
 	release = package.getDownloadRelease()
 
 	if release is None:
@@ -585,6 +591,9 @@ def alias_create_edit(package: Package, alias_id: int = None):
 @login_required
 @is_package_page
 def share(package):
+	if not package.checkPerm(current_user, Permission.SEE_PACKAGE):
+		abort(404)
+
 	return render_template("packages/share.html", package=package,
 			tabs=get_package_tabs(current_user, package), current_tab="share")
 
@@ -592,6 +601,9 @@ def share(package):
 @bp.route("/packages/<author>/<name>/similar/")
 @is_package_page
 def similar(package):
+	if not package.checkPerm(current_user, Permission.SEE_PACKAGE):
+		abort(404)
+
 	packages_modnames = {}
 	for metapackage in package.provides:
 		packages_modnames[metapackage] = Package.query.filter(Package.id != package.id,

app/blueprints/packages/releases.py

@@ -33,6 +33,9 @@ from . import bp, get_package_tabs
 @bp.route("/packages/<author>/<name>/releases/", methods=["GET", "POST"])
 @is_package_page
 def list_releases(package):
+	if not package.checkPerm(current_user, Permission.SEE_PACKAGE):
+		abort(404)
+
 	return render_template("packages/releases_list.html",
 			package=package,
 			tabs=get_package_tabs(current_user, package), current_tab="releases")
@@ -107,6 +110,9 @@ def create_release(package):
 @bp.route("/packages/<author>/<name>/releases/<id>/download/")
 @is_package_page
 def download_release(package, id):
+	if not package.checkPerm(current_user, Permission.SEE_PACKAGE):
+		abort(404)
+
 	release = PackageRelease.query.get(id)
 	if release is None or release.package != package:
 		abort(404)

app/blueprints/packages/reviews.py

@@ -24,7 +24,8 @@ from flask_login import current_user, login_required
 from flask_wtf import FlaskForm
 from wtforms import *
 from wtforms.validators import *
-from app.models import db, PackageReview, Thread, ThreadReply, NotificationType, PackageReviewVote, Package, UserRank
+from app.models import db, PackageReview, Thread, ThreadReply, NotificationType, PackageReviewVote, Package, UserRank, \
+	Permission
 from app.utils import is_package_page, addNotification, get_int_or_abort, isYes, is_safe_url, rank_required
 from app.tasks.webhooktasks import post_discord_webhook
 
@@ -53,6 +54,9 @@ def review(package):
 		flash(gettext("You can't review your own package!"), "danger")
 		return redirect(package.getURL("packages.view"))
 
+	if not package.checkPerm(current_user, Permission.SEE_PACKAGE):
+		abort(404)
+
 	review = PackageReview.query.filter_by(package=package, author=current_user).first()
 
 	form = ReviewForm(formdata=request.form, obj=review)