Add appeals management page

pkg/gcsql/appeals.go

@@ -0,0 +1,85 @@
+package gcsql
+
+import (
+	"database/sql"
+	"strconv"
+)
+
+// GetAppeals returns an array of appeals, optionally limiting them to a specific ban
+func GetAppeals(banID int, limit int) ([]IPBanAppeal, error) {
+	query := `SELECT id, staff_id, ip_ban_id, appeal_text, staff_response, is_denied FROM DBPREFIXip_ban_appeals`
+	if banID > 0 {
+		query += " WHERE ip_ban_id = ?"
+	}
+	if limit > 0 {
+		query += " LIMIT " + strconv.Itoa(limit)
+	}
+	var rows *sql.Rows
+	var err error
+	if banID > 0 {
+		rows, err = QuerySQL(query, banID)
+	} else {
+		rows, err = QuerySQL(query)
+	}
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var appeals []IPBanAppeal
+	for rows.Next() {
+		var appeal IPBanAppeal
+		var staffID *int
+		var staffResponse *string
+		err = rows.Scan(&appeal.ID, &staffID, &appeal.IPBanID, &appeal.AppealText, &staffResponse, &appeal.IsDenied)
+		if err != nil {
+			return nil, err
+		}
+		if staffID != nil {
+			appeal.StaffID = *staffID
+		}
+		if staffResponse != nil {
+			appeal.StaffResponse = *staffResponse
+		}
+		appeals = append(appeals, appeal)
+	}
+	return appeals, nil
+}
+
+// ApproveAppeal deactivates the ban that the appeal was submitted for
+func ApproveAppeal(appealID int, staffID int) error {
+	const deactivateQuery = `UPDATE DBPREFIXip_ban SET is_active = FALSE WHERE id = (
+		SELECT ip_ban_id FROM DBPREFIXip_ban_appeals WHERE id = ?)`
+	const deactivateAppealQuery = `INSERT INTO DBPREFIXip_ban_audit (
+		ip_ban_id, timestamp, staff_id, is_active, is_thread_ban, permanent, staff_note, message, can_appeal)
+		VALUES((SELECT ip_ban_id FROM DBPREFIXip_ban_appeals WHERE id = ?),
+		CURRENT_TIMESTAMP, ?, FALSE, FALSE, FALSE, '', '', TRUE)`
+	const deleteAppealQuery = `DELETE FROM DBPREFIXip_ban_appeals WHERE id = ?`
+	tx, err := BeginTx()
+	if err != nil {
+		return err
+	}
+	defer tx.Rollback()
+	stmt, err := PrepareSQL(deactivateQuery, tx)
+	if err != nil {
+		return err
+	}
+	defer func() {
+		stmt.Close()
+	}()
+	if _, err = stmt.Exec(appealID); err != nil {
+		return err
+	}
+	if stmt, err = PrepareSQL(deactivateAppealQuery, tx); err != nil {
+		return err
+	}
+	if _, err = stmt.Exec(appealID, staffID); err != nil {
+		return err
+	}
+	if stmt, err = PrepareSQL(deleteAppealQuery, tx); err != nil {
+		return err
+	}
+	if _, err = stmt.Exec(appealID); err != nil {
+		return err
+	}
+	return tx.Commit()
+}

pkg/gctemplates/funcs.go

@@ -189,6 +189,13 @@ var funcMap = template.FuncMap{
 		}
 		return username
 	},
+	"getAppealBanIP": func(appealID int) string {
+		ban, err := gcsql.GetIPBanByID(appealID)
+		if err != nil || ban == nil {
+			return "?"
+		}
+		return ban.IP
+	},
 	"getCatalogThumbnail": func(img string) string {
 		return gcutil.GetThumbnailPath("catalog", img)
 	},

pkg/gctemplates/templates.go

@@ -18,6 +18,7 @@ var (
 	FrontPage         *template.Template
 	BoardPage         *template.Template
 	JsConsts          *template.Template
+	ManageAppeals     *template.Template
 	ManageBans        *template.Template
 	ManageBoards      *template.Template
 	ManageSections    *template.Template
@@ -130,6 +131,12 @@ func templateLoading(t string, buildAll bool) error {
 			return templateError("threadpage.html", err)
 		}
 	}
+	if buildAll || t == "manageappeals" {
+		ManageAppeals, err = loadTemplate("manage_appeals.html")
+		if err != nil {
+			return templateError("manage_appeals.html", err)
+		}
+	}
 	if buildAll || t == "managebans" {
 		ManageBans, err = loadTemplate("manage_bans.html")
 		if err != nil {

pkg/manage/actions.go

@@ -287,6 +287,63 @@ var actions = []Action{
 			outputStr += manageBansBuffer.String()
 			return outputStr, nil
 		}},
+	{
+		ID:          "appeals",
+		Title:       "Ban appeals",
+		Permissions: ModPerms,
+		JSONoutput:  OptionalJSON,
+		Callback: func(writer http.ResponseWriter, request *http.Request, staff *gcsql.Staff, wantsJSON bool, infoEv, errEv *zerolog.Event) (output interface{}, err error) {
+			banIDstr := request.FormValue("banid")
+			var banID int
+			if banIDstr != "" {
+				if banID, err = strconv.Atoi(banIDstr); err != nil {
+					errEv.Err(err).Caller().Send()
+					return "", err
+				}
+			}
+			infoEv.Int("banID", banID)
+
+			limitStr := request.FormValue("limit")
+			limit := 20
+			if limitStr != "" {
+				if limit, err = strconv.Atoi(limitStr); err != nil {
+					errEv.Err(err).Caller().Send()
+					return "", err
+				}
+			}
+			approveStr := request.FormValue("approve")
+			if approveStr != "" {
+				// approving an appeal
+				approveID, err := strconv.Atoi(approveStr)
+				if err != nil {
+					errEv.Err(err).
+						Str("approveStr", approveStr).Caller().Send()
+				}
+				if err = gcsql.ApproveAppeal(approveID, staff.ID); err != nil {
+					errEv.Err(err).
+						Int("approveAppeal", approveID).
+						Caller().Send()
+					return "", err
+				}
+			}
+
+			appeals, err := gcsql.GetAppeals(banID, limit)
+			if err != nil {
+				errEv.Err(err).Caller().Send()
+				return "", errors.New("Unable to get appeals: " + err.Error())
+			}
+
+			manageAppealsBuffer := bytes.NewBufferString("")
+			pageData := map[string]interface{}{}
+			if appeals != nil && len(appeals) > 0 {
+				pageData["appeals"] = appeals
+			}
+			if err = serverutil.MinifyTemplate(gctemplates.ManageAppeals, pageData, manageAppealsBuffer, "text/html"); err != nil {
+				errEv.Err(err).Str("template", "manage_appeals.html").Caller().Send()
+				return "", errors.New("Error executing appeal management page template: " + err.Error())
+			}
+			return manageAppealsBuffer.String(), err
+		}},
 	{
 		ID:          "filebans",
 		Title:       "Filename and checksum bans",

templates/manage_appeals.html

@@ -0,0 +1,7 @@
+<table border="1">
+<tr><th>Action</th><th>Appeal Text</th><th>Banned IP</th></tr>
+{{range $_,$appeal := $.appeals}}
+<tr><td><a href="{{webPath "manage"}}?action=appeals&approve={{$appeal.ID}}">Approve</a> | <a href="{{webPath "manage"}}?action=appeals&deny={{$appeal.ID}}">Deny</a></td><td>{{$appeal.AppealText}}</td><td>{{getAppealBanIP $appeal.IPBanID}}</td></tr>
+<tr></tr>
+{{end}}
+</table>