Add titles to pages, check user for project actions

biscd/biscd/routes.py

@@ -54,7 +54,7 @@ def register():
 @app.route('/project/public', methods=['GET'])
 def public_projects():
     projects = Project.get(access__public = True)
-    return render_template('projects.html', projects=projects)
+    return render_template('projects.html', title='Public Projects', projects=projects)
 
 @app.route('/project/add', methods=['GET', 'POST'])
 @login_required
@@ -69,7 +69,7 @@ def project_add():
         project.save()
         flash('Your project is created!', 'success')
         return redirect(url_for('project_dashboard', project_name=project.name))
-    return render_template('project_settings.html', form=form, project=project)
+    return render_template('project_settings.html', title='Add Project', form=form, project=project)
 
 @app.route('/project/<project_name>/settings', methods=['GET', 'POST'])
 @login_required
@@ -92,7 +92,7 @@ def project_change_settings(project_name):
         flash(f"{project.name} was updated!", 'success')
         return redirect(url_for('project_dashboard', project_name=project.name))
 
-    return render_template('project_settings.html', form=form, project=project)
+    return render_template('project_settings.html', title=f'{project.name}: Settings', form=form, project=project)
 
 @app.route('/project/<project_name>', methods=['GET'])
 def project_dashboard(project_name):
@@ -100,12 +100,14 @@ def project_dashboard(project_name):
     access = project.user_access(current_user)
     if access is None:
         abort(404)
-    return render_template('project.html', project=project, owner=(access == 'Owner'))
+    return render_template('project.html', title=f'{project.name}', project=project, owner=(access == 'Owner'))
 
 @app.route('/project/<project_name>/update', methods=['GET'])
 @login_required
 def project_update(project_name):
     project = Project.first_or_404(name=project_name)
+    if project.user_access(current_user) != 'Owner':
+        abort(401)
     result = project.update()
     flash_result(result)
     return redirect(url_for('project_dashboard', project_name=project.name))
@@ -114,6 +116,8 @@ def project_update(project_name):
 @login_required
 def project_delete_files(project_name):
     project = Project.first_or_404(name=project_name)
+    if project.user_access(current_user) != 'Owner':
+        abort(401)
     result = project.delete_files()
     flash_result(result)
     return redirect(url_for('project_dashboard', project_name=project.name))