version advance, schema changes, style changes, terms and privacy policy, added installer script

2023-03-17 23:26:05 +01:00 · 2023-03-17 23:26:05 +01:00 · c46b07a3b2
commit c46b07a3b2
parent 9f9525ecd1
16 changed files with 446 additions and 51 deletions
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@ -1,5 +1,18 @@
 # What’s New

+## 0.8
+
+ Schema changes:
+  + New tables `UserGroup`, `UserGroupMembership` and `PagePermission`.
+  + Added flag `is_cw` to `Page`.
+  + Added `restrictions` field to `User`.
+ Pages now can have a Content Warning. It prevents them to show up in previews, and adds a
+  caution message when viewing them.
+ Added Terms and Privacy Policy.
+ Changed user page URLs (contributions page) from `/u/user` to `/@user`.
+ Style changes: added a top bar with the site title. It replaces the floating menu on the top right.
+ Added a built-in installer (`app_init.py`). You still need to manually create `site.conf`.
+
 ## 0.7.1

 + Improved calendar view. Now `/calendar` shows a list of years and months.
--- a/README.md
+++ b/README.md
@ -43,9 +43,14 @@ name = Salvi
 directory = /path/to/database/
 ```

+ Run `python3 -m app_init` to initialize the database and create the administrator user.
 + Run `flask run`.
 + You can now access Salvi in your browser at port 5000.

+## Caveats
+
+ The whole application is untested.
+ If you forget the password, there is currently no way to reset it.

 ## License

--- a/app.py
+++ b/app.py
@ -28,8 +28,9 @@ from urllib.parse import quote
 from configparser import ConfigParser
 import i18n
 import gzip
+from getpass import getpass

-__version__ = '0.7.1'
+__version__ = '0.8-dev'

 #### CONSTANTS ####

@ -65,10 +66,8 @@ if _cfp.read([CONFIG_FILE]):
                v = fallback
        return v
 else:
-    def _getconf(k1, k2, fallback=None, cast=None):
-        if fallback is None:
-            fallback = DEFAULT_CONF.get((k1, k2))
-        return fallback
+    print('Uh oh, site.conf not found.')
+    exit(-1)

 #### OPTIONAL IMPORTS ####

@ -148,6 +147,8 @@ class User(BaseModel):
    karma = IntegerField(default=1)
    privileges = BitField()
    is_admin = privileges.flag(1)
+    restrictions = BitField()
+    is_disabled = restrictions.flag(1)

    # helpers for flask_login
    @property
@ -155,11 +156,42 @@ class User(BaseModel):
        return False
    @property
    def is_active(self):
-        return True
+        return not self.is_disabled
    @property
    def is_authenticated(self):
        return True

+class UserGroup(BaseModel):
+    name = CharField(32, unique=True)
+    permissions = BitField()
+    # Can read pages.
+    can_read = permissions.flag(1)
+    # Can edit all non-locked pages.
+    can_edit = permissions.flag(2)
+    # Can create and edit their own pages.
+    can_create = permissions.flag(4)
+    # Can set page URL.
+    can_set_url = permissions.flag(8)
+    # Can change page tags.
+    can_set_tags = permissions.flag(16)
+
+    @classmethod
+    def get_default_group(cls):
+        try:
+            return cls[1]
+        except cls.DoesNotExist:
+            return cls.get(cls.name == 'default')
+
+class UserGroupMembership(BaseModel):
+    user = ForeignKeyField(User, backref='group_memberships')
+    group = ForeignKeyField(UserGroup, backref='user_memberships')
+    since = DateTimeField(default=datetime.datetime.now)
+
+    class Meta:
+        indexes = (
+            (('user', 'group'), True),
+        )
+

 class Page(BaseModel):
    url = CharField(64, unique=True, null=True)
@ -172,6 +204,7 @@ class Page(BaseModel):
    is_sync = flags.flag(2)
    is_math_enabled = flags.flag(4)
    is_locked = flags.flag(8)
+    is_cw = flags.flag(16)
    @property
    def latest(self):
        if self.revisions:
@ -179,6 +212,8 @@ class Page(BaseModel):
    def get_url(self):
        return '/' + self.url + '/' if self.url else '/p/{}/'.format(self.id)
    def short_desc(self):
+        if self.is_cw:
+            return '(Content Warning)'
        full_text = self.latest.text
        text = remove_tags(full_text, convert = not self.is_math_enabled and not _getconf('appearance', 'simple_remove_tags', False))
        return text[:200] + ('\u2026' if len(text) > 200 else '')
@ -377,13 +412,76 @@ class PageLink(BaseModel):
    def refresh_all_links(cls):
        for p in Page.select():
            cls.parse_links(p, p.latest.text)
-            
+
+class PagePermission(BaseModel):
+    page = ForeignKeyField(Page, backref='permission_overrides')
+    group = ForeignKeyField(UserGroup, backref='page_permissions')
+    permissions = BitField()
+    # Can read pages.
+    can_read = permissions.flag(1)
+    # Can edit all non-locked pages.
+    can_edit = permissions.flag(2)
+    # Can create and edit their own pages.
+    can_create = permissions.flag(4)
+    # Can set page URL.
+    can_set_url = permissions.flag(8)
+    # Can change page tags.
+    can_set_tags = permissions.flag(16)
+
+    class Meta:
+        indexes = (
+            (('page', 'group'), True),
+        )

 def init_db():
    database.create_tables([
-        User, Page, PageText, PageRevision, PageTag, PageProperty, PageLink
+        User, UserGroup, UserGroupMembership,
+        Page, PageText, PageRevision, PageTag, PageProperty, PageLink,
+        PagePermission
    ])

+def init_db_and_create_first_user():
+    try:
+        User[1]
+        UserGroup[1]
+    except Exception:
+        pass
+    else:
+        print('Looks like this site is already set up!')
+        return
+    username = input('Username: ')
+    password = getpass('Password: ')
+    confirm_password = getpass('Confirm password: ')
+    email = input('Email: (optional)') or None
+    if not is_username(username):
+        print('Invalid username: usernames can contain only letters, numbers, underscores and hyphens.')
+        return
+    if password != confirm_password:
+        print('Passwords do not match.')
+        return
+    default_permissions = 31 # all permissions
+    if not input('Agree to the Terms of Use?')[0].lower() == 'y':
+        print('You must accept Terms in order to register.')
+        return
+    with database.atomic():
+        init_db()
+        ua = User.create(
+            username = username,
+            email = email,
+            password = generate_password_hash(password),
+            join_date = datetime.datetime.now(),
+            is_admin = True
+        )
+        ug = UserGroup.create(
+            name = 'default',
+            permissions = int(default_permissions)
+        )
+        UserGroupMembership.create(
+            user = ua,
+            group = ug
+        )
+    print('Installed successfully!')
+
 #### WIKI SYNTAX ####

 def md(text, expand_magic=False, toc=True, math=True):
@ -456,8 +554,7 @@ login_manager.login_view = 'accounts_login'

 #### ROUTES ####

-@app.before_request
-def _before_request():
+def _get_lang():
    if request.args.get('uselang') is not None:
        lang = request.args['uselang']
    else:
@ -468,12 +565,17 @@ def _before_request():
                break
        else:
            lang = 'en'
-    g.lang = lang
+    return lang
+
+@app.before_request
+def _before_request():
+    g.lang = _get_lang()

@app.context_processor
 def _inject_variables():
+    
    return {
-        'T': partial(get_string, g.lang),
+        'T': partial(get_string, _get_lang()),
        'app_name': _getconf('site', 'title'),
        'strong': lambda x:Markup('<strong>{0}</strong>').format(x),
        'app_version': __version__,
@ -492,6 +594,7 @@ def linebreaks(text):
    text = text.replace("\n\n", '</p><p>').replace('\n', '<br />')
    return Markup(text)

+app.template_filter(name='markdown')(md)

@app.route('/')
 def homepage():
@ -523,6 +626,10 @@ def error_400(body):

@app.errorhandler(500)
 def error_500(body):
+    try:
+        User[1]
+    except OperationalError:
+        g.need_install = True
    return render_template('internalservererror.jinja2'), 500

 # Middle point during page editing.
@ -550,7 +657,8 @@ def savepoint(form, is_preview=False, pageobj=None):
        preview=preview,
        pl_js_info=pl_js_info,
        pl_calendar=('usecalendar' in form) and form['calendar'],
-        pl_readonly=not pageobj.can_edit(current_user) if pageobj else False
+        pl_readonly=not pageobj.can_edit(current_user) if pageobj else False,
+        pl_cw=('cw' in form) and form['cw']
    )

@app.route('/create/', methods=['GET', 'POST'])
@ -581,7 +689,8 @@ def create():
                owner_id=current_user.id,
                calendar=datetime.date.fromisoformat(request.form["calendar"]) if 'usecalendar' in request.form else None,
                is_math_enabled='enablemath' in request.form,
-                is_locked = 'lockpage' in request.form
+                is_locked = 'lockpage' in request.form,
+                is_cw = 'cw' in request.form
            )
            p.change_tags(p_tags)
        except IntegrityError as e:
@ -636,6 +745,7 @@ def edit(id):
        p.touched = datetime.datetime.now()
        p.is_math_enabled = 'enablemath' in request.form
        p.is_locked = 'lockpage' in request.form
+        p.is_cw = 'cw' in request.form
        p.calendar = datetime.date.fromisoformat(request.form["calendar"]) if 'usecalendar' in request.form else None
        p.save()
        p.change_tags(p_tags)
@ -767,12 +877,6 @@ def view_named(name):
        abort(404)
    return render_template('view.jinja2', p=p, rev=p.latest)

-@app.route('/init-config/tables/')
-def init_config_tables():
-    init_db()
-    flash('Tables successfully created.')
-    return redirect('/')
-
@app.route('/history/<int:id>/')
 def history(id):
    try:
@ -782,6 +886,10 @@ def history(id):
    return render_template('history.jinja2', p=p, history=p.revisions.order_by(PageRevision.pub_date.desc()))

@app.route('/u/<username>/')
+def contributions_legacy_url(username):
+    return redirect(f'/@{username}/')
+
+@app.route('/@<username>/')
 def contributions(username):
    try:
        user = User.get(User.username == username)
@ -913,6 +1021,10 @@ def accounts_register():
                    password = generate_password_hash(password),
                    join_date = datetime.datetime.now()
                )
+                UserGroupMembership.create(
+                    user = u,
+                    group = UserGroup.get_default_group()
+                )
            
            login_user(u)
            return redirect(request.args.get('next', '/'))
@ -1058,7 +1170,6 @@ class Importer(object):
                continue
        return no_pages, no_revs

-
@app.route('/manage/export/', methods=['GET', 'POST'])
 def exportpages():
    if request.method == 'POST':
@ -1103,6 +1214,16 @@ def importpages():
            flash('Pages can be imported by Administrators only!')
    return render_template('importpages.jinja2')

+## terms / privacy ##
+
+@app.route('/terms/')
+def terms():
+    return render_template('terms.jinja2')
+
+@app.route('/privacy/')
+def privacy():
+    return render_template('privacy.jinja2')
+
 #### EXTENSIONS ####

 active_extensions = []
--- a/app_init.py
+++ b/app_init.py
@ -0,0 +1,5 @@
+from app import init_db_and_create_first_user
+
+
+if __name__ == '__main__':
+    init_db_and_create_first_user()
--- a/migrations/0_7to0_8.py
+++ b/migrations/0_7to0_8.py
@ -0,0 +1,23 @@
+from playhouse.migrate import migrate, SqliteMigrator, MySQLMigrator
+from peewee import MySQLDatabase, SqliteDatabase, \
+    IntegerField, DateTimeField, ForeignKeyField, DeferredForeignKey, BitField
+from app import database, UserGroup, UserGroupMembership, PagePermission
+
+
+if type(database) == MySQLDatabase:
+    migrator = MySQLMigrator(database)
+elif type(database) == SqliteDatabase:
+    migrator = SqliteMigrator(database)
+else:
+    print("Unsupported database")
+    exit()
+
+with database.atomic():
+    database.create_tables([UserGroup, UserGroupMembership, PagePermission])
+    migrate(
+        migrator.add_column('user', 'restrictions', BitField())
+    )
+    UserGroup.create(
+        name='default',
+        permissions=31
+    )
--- a/static/style.css
+++ b/static/style.css
@ -22,8 +22,15 @@

 /* basic styles */
 * {box-sizing: border-box;}
-body{font-family:sans-serif;background-color:var(--bg-main); color: var(--fg-main)}
+body{font-family:sans-serif;background-color:var(--bg-main); color: var(--fg-main);margin:0;position:relative}
 .content{margin: 3em 1.3em}
+.footer{text-align:center;}
+
+/* header styles */
+.header{padding:1em;display:flex;flex-direction:row;justify-content:space-between;position:sticky;top:0;background-color:var(--bg-alt); z-index: 99}
+.header .header-blank {flex: 1; margin: 0 .5em}
+.header ul{list-style:none;padding:0;margin:0;font-size:0.9em;border-left:var(--border) 1px solid}
+.header ul > li{display:inline-block;padding-right:1em}

 /* content styles */
 #firstHeading {font-family:sans-serif; text-align: center;font-size:3em; font-weight: normal}
@ -105,8 +112,6 @@ ul.inline > li:last-child::after {content: ""}


 /* floating elements */
-.top-menu{list-style:none;padding:0;margin:0;font-size:0.9em;position:absolute;right:0;top:.5em;text-transform:lowercase}
-.top-menu li{display:inline-block;padding-right:1em}
 .toc{float:right}
@media (max-width:639px){
  .toc{display:none}
--- a/templates/base.jinja2
+++ b/templates/base.jinja2
@ -27,23 +27,33 @@
    {% endif %}
    {% block json_info %}{% endblock %}
  </head>
-  <body{% if request.cookies.get('dark') == '1' %} class="dark"{% endif %}>
+  <body {% if request.cookies.get('dark') == '1' %}class="dark"{% endif %}>
    <div id="__top"></div>
+    <header class="header">
+      <span class="header-app-name"><a href="/">{{ app_name }}</a></span>
+      <span class="header-blank">&nbsp;</span>
+      <ul class="top-menu">
+        <li class="dark-theme-toggle-anchor"><a href="{{ url_for('theme_switch', next=request.path) }}" onclick="toggleDarkTheme(true);return false" class="dark-theme-toggle-on" title="Dark theme"><span class="material-icons">brightness_3</span></a><a href="{{ url_for('theme_switch', next=request.path) }}" onclick="toggleDarkTheme(false);return false" class="dark-theme-toggle-off" title="Light theme"><span class="material-icons">brightness_5</span></a><script>function toggleDarkTheme(a){document.cookie="dark="+(+a)+";max-age=31556952;path=/;SameSite=Strict";document.body.classList.toggle("dark",a)}</script></li>
+        <li><a href="/search/" title="{{ T('search') }}" rel="nofollow"><span class="material-icons">search</span></a></li>
+        <li><a href="/p/random/" title="{{ T('random-page') }}" rel="nofollow"><span class="material-icons">shuffle</span></a></li>
+        <li><a href="/create/" title="{{ T('new-note') }}" rel="nofollow"><span class="material-icons">create</span></a></li>
+      </ul>
+      <ul class="user_menu">
+        {% if current_user.is_authenticated %}
+        <li><a href="/@{{ current_user.username }}/">{{ current_user.username }}</a></li>
+        <li><a href="/accounts/logout/" title="{{ T('logout') }}" rel="nofollow"><span class="material-icons">logout</span></a></li>
+        {% else %}
+        <li><a href="/accounts/login/" title="{{ T('login') }}" rel="nofollow"><span class="material-icons">login</span></a></li>
+        {% endif %}
+      </ul>
+    </header>
    <div class="content">
      {% for msg in get_flashed_messages() %}
      <div class="flash">{{ msg }}</div>
      {% endfor %}
      {% block content %}{% endblock %}
    </div>
-    <ul class="top-menu">
-      <li class="dark-theme-toggle-anchor"><a href="{{ url_for('theme_switch', next=request.path) }}" onclick="toggleDarkTheme(true);return false" class="dark-theme-toggle-on" title="Dark theme"><span class="material-icons">brightness_3</span></a><a href="{{ url_for('theme_switch', next=request.path) }}" onclick="toggleDarkTheme(false);return false" class="dark-theme-toggle-off" title="Light theme"><span class="material-icons">brightness_5</span></a><script>function toggleDarkTheme(a){document.cookie="dark="+(+a)+";max-age=31556952;path=/;SameSite=Strict";document.body.classList.toggle("dark",a)}</script></li>
-      <li><a href="/" title="{{ T('homepage') }}"><span class="material-icons">home</span></a></li>
-      <li><a href="/search/" title="{{ T('search') }}" rel="nofollow"><span class="material-icons">search</span></a></li>
-      <li><a href="/p/random/" title="{{ T('random-page') }}" rel="nofollow"><span class="material-icons">shuffle</span></a></li>
-      <li><a href="/create/" title="{{ T('new-note') }}" rel="nofollow"><span class="material-icons">create</span></a></li>
-      <li><a href="/accounts/login/" title="{{ T('login') }}" rel="nofollow"><span class="material-icons">login</span></a></li>
-    </ul>
-    <div class="footer">
+    <footer class="footer">
      <div class="footer-copyright">&copy; 2020–2023 Sakuragasaki46.</div>
      <div class="footer-loggedinas">
        {% if current_user.is_authenticated %}
@ -54,7 +64,7 @@
      </div>
      <div class="footer-actions" id="page-actions">{% block actions %}{% endblock %}</div>
      <div class="footer-versions">{{app_name}} version {{app_version}}</div>
-    </div>
+    </footer>
    <div class="backontop"><a href="#__top" title="Back on top"><span class="material-icons">arrow_upward</span></a></div>
    {% block scripts %}{% endblock %}
  </body>
--- a/templates/edit.jinja2
+++ b/templates/edit.jinja2
@ -82,6 +82,10 @@
    <label for="CB__usecalendar">Use calendar:</label>
    <input type="date" name="calendar" {% if pl_calendar %}value="{{ pl_calendar }}"{% endif %}>
  </div>
+  <div>
+    <input type="checkbox" id="CB__cw" name="cw" {% if pl_cw %}checked=""{% endif %}>
+    <label for="CB__cw">Content Warning</label>
+  </div>
  {% endif %}
 </form>

--- a/templates/history.jinja2
+++ b/templates/history.jinja2
@ -22,9 +22,13 @@
      {% endif %}
    </a>
    by
+    {% if rev.user_id %}
    <a href="/u/{{ rev.user.username }}">
      {{ rev.user.username }}
    </a>
+    {% else %}
+    <span>&lt;Unknown User&gt;</span>
+    {% endif %}
  </li>
 {% endfor %}
 </ul>
--- a/templates/home.jinja2
+++ b/templates/home.jinja2
@ -18,11 +18,13 @@
    <a href="{{ n.get_url() }}" class="nl-title">{{ n.title }}</a>
    <p class="nl-desc">{{ n.short_desc() }}</p>
    {% if n.tags %}
-    <p class="nl-tags">{{ T('tags') }}: 
-    {% for tag in n.tags %}
+    <p class="nl-tags">
+      <span class="material-icons">tag</span>
+      {{ T('tags') }}: 
+      {% for tag in n.tags %}
      {% set tn = tag.name %}
      <a href="/tags/{{ tn }}/" class="nl-tag">#{{ tn }}</a>
-    {% endfor %}
+      {% endfor %}
    </p>
    {% endif %}
    {% if n.calendar %}
--- a/templates/listrecent.jinja2
+++ b/templates/listrecent.jinja2
@ -14,11 +14,13 @@
    <a href="{{ n.get_url() }}" class="nl-title">{{ n.title }}</a>
    <p class="nl-desc">{{ n.short_desc() }}</p>
    {% if n.tags %}
-    <p class="nl-tags">{{ T('tags') }}: 
-    {% for tag in n.tags %}
+    <p class="nl-tags">
+      <span class="material-icons">tag</span>
+      {{ T('tags') }}: 
+      {% for tag in n.tags %}
      {% set tn = tag.name %}
      <a href="/tags/{{ tn }}/" class="nl-tag">#{{ tn }}</a>
-    {% endfor %}
+      {% endfor %}
    </p>
    {% endif %}
    {% if n.calendar %}
--- a/templates/listtag.jinja2
+++ b/templates/listtag.jinja2
@ -16,21 +16,23 @@
  <li>
    <a href="{{ n.get_url() }}" class="nl-title">{{ n.title }}</a>
    <p class="nl-desc">{{ n.short_desc() }}</p>
-    <p class="nl-tags">Tags: 
-    {% for tag in n.tags %}
+    <p class="nl-tags">
+      <span class="material-icons">tag</span>
+      {{ T('tags') }}: 
+      {% for tag in n.tags %}
      {% set tn = tag.name %}
      {% if tn == tagname %}
      <strong class="nl-tag-hl">#{{ tn }}</strong>
      {% else %}
      <a href="/tags/{{ tn }}/" class="nl-tag">#{{ tn }}</a>
      {% endif %}
-    {% endfor %}
-    {% if n.calendar %}
-    <p class="nl-calendar">
-      <span class="material-icons">calendar_today</span>
-      <time datetime="{{ n.calendar.isoformat() }}">{{ n.calendar.strftime('%B %-d, %Y') }}</time>
-    </p>
-    {% endif %}
+      {% endfor %}
+      {% if n.calendar %}
+      <p class="nl-calendar">
+        <span class="material-icons">calendar_today</span>
+        <time datetime="{{ n.calendar.isoformat() }}">{{ n.calendar.strftime('%B %-d, %Y') }}</time>
+      </p>
+      {% endif %}
    </p>
  </li>
  {% endfor %}
--- a/templates/privacy.jinja2
+++ b/templates/privacy.jinja2
@ -0,0 +1,46 @@
+{% extends "base.jinja2" %}
+
+{% block title %}Privacy Policy — {{ app_name }}{% endblock %}
+
+
+{% block content %}
+
+<h1 id="firstHeading">Privacy Policy</h1>
+
+<div class="inner-content">
+{% filter markdown %}
+# Privacy
+
+## Cookies
+
+{{ app_name }} uses one cryptographically signed cookie to maintain secure authenticated sessions. This cookie is randomized with each new session.
+
+This cookie is used for the following purposes:
+
+* Authentication
+* Abuse mitigation
+* Per-device settings like light/dark theme selection.
+
+This cookie is mandatory and cannot be opted out. Manual alteration or removal of this cookie will result in deauthentication and reversion to default per-device settings.
+
+## Your information
+
+We collect basic information in order to operate the platform, and to mitigate abuse. This includes:
+
+* Your email address, if you choose to provide it.
+* The IP address from which content is submitted.
+* Whether or not you have indicated that you are 18 years of age.
+* Other saved personal preferances, which you can edit from your account settings.
+
+We use - and then promptly forget - the following information about you from third parties:
+
+* Verification from our captcha provider that you aren't a bot, during account registration
+
+{{ app_name }} will not release your information to third parties, except:
+
+* As required by Italian law
+* At our discretion, {{ app_name }} may share your information with Italian law enforcement in the event of an emergency, if we have good cause to believe that doing so would avert or mitigate the emergency.
+{% endfilter %}
+
+</div>
+{% endblock %}
--- a/templates/register.jinja2
+++ b/templates/register.jinja2
@ -25,7 +25,7 @@
    </div>
    <div>
        <input type="checkbox" name="legal" value="1" />
-        <label>{{ T('have-read-terms').format(T('terms-of-service'), T('privacy-policy')) }}</label>
+        <label>{{ T('have-read-terms').format(('<a href="/terms/">%s</a>' | safe) % T('terms-of-service'), ('<a href="/privacy/">%s</a>' | safe) % T('privacy-policy')) }}</label>
    </div>
    <div>
        <input type="submit" value="{{ T('sign-up') }}" />
--- a/templates/terms.jinja2
+++ b/templates/terms.jinja2
@ -0,0 +1,145 @@
+{% extends "base.jinja2" %}
+
+{% block title %}Terms of Service — {{ app_name }}{% endblock %}
+
+{% block content %}
+<h1 id="firstHeading">Terms of Service</h1>
+
+<div class="inner-content">
+{% filter markdown %}
+## Scope and Definitions
+
+These terms of service ("Terms") are between {{ app_name }} 
+("{{ request.headers['Host'] }}") and You, regarding Your use of the social platform 
+{{ app_name }}, and any other services or test servers which may exist 
+now or in the future (collectively "{{ app_name }}").
+
+Content on this page displayed in blockquotes is provided for convenience 
+and readability only. Blockquote text is not part of the terms of service.
+
+## Conduct and content
+
+You agree to follow the Content Policy [here](/rules/). 
+The Content Policy is incorporated into these Terms by this reference.
+
+## Age
+
+You warrant that You are at least 13 years old. 
+You warrant that You are at least 18 years old, 
+if You indicate as such in Your user settings.
+
+
+## Account Access
+
+Your {{ app_name }} account is nontransferable. You will not buy, sell, gift, loan, or otherwise grant a third party access to Your {{ app_name }} account. You will not provide a third party with Your {{ app_name }} password or two-factor authentication codes.
+
+In the event that Your {{ app_name }} account is accessed by a third party anyways, You remain accountable for all actions taken by Your account.
+
+## Liability
+
+{{ app_name }} shall not be liable for Your damages arising from any of the following:
+
+* Use of the {{ app_name }} platform
+* Technical failure of {{ app_name }}
+* Administrative actions performed by {{ app_name }}, including both automatic and manual actions
+* Unauthorized access of a third party to Your {{ app_name }} account
+* Loss or breach of {{ app_name }} data
+* Force majeur
+
+You accept full liability for all content You upload to, or embed within, {{ app_name }}, and indemnify {{ app_name }} from all such liability.
+
+> You are responsible for everything You do, and everything that happens with, with Your {{ app_name }} account. Don't use {{ app_name }} to store important data or sensitive data.
+
+## Intellectual Property
+
+You grant {{ app_name }} a permanent, worldwide, and irrevocable license to store, modify, copy, and distribute all content that You submit to or upload to {{ app_name }}, including any creative works. Additionally, You grant {{ app_name }} a permanent, worldwide, and irrevocable license to sublicense these same rights to {{ app_name }}'s service providers. Additionally, You warrant that You are authorized to grant {{ app_name }} these rights.
+
+You retain all other intellectual property rights, including ownership.
+
+> We need to be able to store, copy, and distribute Your content, because that's just how websites like {{ app_name }} work. We also need to be able to modify it for security and formatting purposes.
+
+## Acceptable Use
+
+You will not use {{ app_name }} as a means to support any other website or service without written permission by {{ app_name }}.
+
+You will not attempt to gain access to a {{ app_name }} account that does not belong to You.
+
+You will not use {{ app_name }} to engage in child sexual abuse activities, as defined in the [CSAM Policy](/help/csam). The CSAM Policy is incorporated into these terms by this reference.
+
+## Multiple Accounts
+
+You are permitted to create and use multiple {{ app_name }} accounts.
+
+You will not use multiple accounts to circumvent per-user limits.
+
+Additionally, these terms apply to all of Your accounts, which may exist now or in the future. {{ app_name }} reserves the right to take administrative action against all of Your accounts in the event of a terms of service violation on any of Your accounts.
+
+## Your Privacy
+
+{{ app_name }} will never intentionally share Your personal information with third parties, except:
+
+* As required by United States law.
+* We will share Your data with our own service providers that are necessary for {{ app_name }} operations.
+* At our discretion, {{ app_name }} may share Your information with United States law enforcement in the event of an emergency, if we have good cause to believe that doing so would avert or mitigate the emergency.
+
+{{ app_name }} will make all reasonable efforts to ensure that user information is kept confidential.
+
+## Legal Forms
+
+{{ app_name }} grants You the ability to use Your {{ app_name }} account to send us certain types of legal forms through our help portal. These include, but are not limited to:
+
+* DMCA takedown request
+* DMCA takedown counter-request
+* Subpoenas and court orders
+
+You acknowledge that these forms are provided for the sake of convenience and speed, and that {{ app_name }} does not waive any of its rights regarding legal process, including the right to object for lack of proper service.
+
+You agree to refrain from making abusive, frivolous, or otherwise improper submissions to these forms. This includes, but is not limited to:
+
+* Nonsensical or incomplete requests
+* Duplicate submissions
+* DMCA takedown requests not made in good faith
+* DMCA takedown requests for content protected by Fair Use
+* DMCA takedown requests for content that you are not authorized to claim.
+* Legal demands not based in fact and/or not backed by appropriate law.
+* Legal documents from courts or law enforcement that lack jurisdiction inside the United States
+* Legal documents that are not in English and are not accompanied by an official English translation.
+
+## Enforcement
+
+{{ app_name }} retains sole discretion in all determinations regarding content policy and terms of service violations.
+
+{{ app_name }} reserves the right to remove content that we deem to violate content policy or the terms of service, and to deactivate accounts responsible for such violations.
+
+## Severability
+
+If one clause of these Terms or the Content Policy is determined by a court to be unenforceable, the remainder of the Terms and Content Policy shall remain in force.
+
+## No Implied Waiver
+
+A failure by {{ app_name }} in one or more instances to insist upon Your strict adherence to these terms or the Content Policy, shall not be construed as a waiver of any continuing or subsequent violations of these terms or the Content Policy.
+
+## Completeness
+
+These Terms, together with the other policies incorporated into them by reference, contain all the terms and conditions agreed upon by You and {{ app_name }} regarding Your use of the {{ app_name }} service. No other agreement, oral or otherwise, will be deemed to exist or to bind either of the parties to this Agreement.
+
+## Governing Law
+
+These terms of service are governed by, and shall be interpreted in accordance with, the laws of Italy. You consent to the sole jurisdiction of Italy for all disputes between You and {{ app_name }}, and You consent to the sole application of Italian and E.U. law for all such disputes.
+
+## Updates
+
+{{ app_name }} may periodically update these terms of service and/or the Content Policy. When this happens, {{ app_name }} will make reasonable efforts to notify You of such changes.
+
+Whenever {{ app_name }} updates these terms of service or the Content Policy, Your continued use of the {{ app_name }} platform constitutes Your agreement to the updated terms of service.
+
+## Translations
+
+If there is any inconsistency between these terms and any translation into other languages, the English language version takes precedence.
+
+
+
+{% endfilter %}
+
+</div>
+{% endblock %}
--- a/templates/view.jinja2
+++ b/templates/view.jinja2
@ -19,6 +19,14 @@

  {% block history_nav %}{% endblock %}

+  {% if p.is_cw %}
+  <div class="flash">
+    <strong>Content Warning</strong> -
+    this page may contain shocking or unexpected content, spoilers, or similar.
+    Proceed with caution.
+  </div>
+  {% endif %}
+
  <div class="inner-content">
    {{ rev.html(math = request.args.get('math') not in ['0', 'false', 'no', 'off'])|safe }}
  </div>