pass a viewer object to templates where applicable

bin/lint-staged

@@ -1,6 +1,6 @@
 #!/bin/bash
 
-set -eo pipefail
+set -euo pipefail
 
 STAGED=$(git diff --name-only --cached --diff-filter=d)
 JS="$(echo $(grep ".*\.js$" <<< "$STAGED" || true))"
@@ -9,7 +9,6 @@ CSS="$(echo $(grep ".*\.scss$" <<< "$STAGED" || true))"
 TWIG="$(echo $(grep ".*\.twig$" <<< "$STAGED" || true))"
 
 if [ -z "$JS" ] && [ -z "$PHP" ] && [ -z "$CSS" ] && [ -z "$TWIG" ]; then
-    echo "Nothing to lint."
     exit 0
 fi
 
@@ -21,6 +20,13 @@ fi
 
 if [ -n "$TWIG" ]; then
     echo "Linting Twig"
+    for t in $TWIG
+    do
+        if ! git grep -qc "${t/templates\//}"; then
+            echo "$t not referenced in codebase"
+            exit 1
+        fi
+    done
     docker compose exec -T web bin/twig-parse $TWIG
 fi
 

classes/view.class.php

@@ -142,7 +142,7 @@ class View {
             'document'    => $module,
             'dono_target' => $payMan->monthlyPercent(new Gazelle\Manager\Donation()),
             'nav_links'   => $navLinks,
-            'user'        => $Viewer,
+            'viewer'      => $Viewer,
         ]);
     }
 

sections/bonus/title.php

@@ -43,9 +43,9 @@ if (isset($_POST['confirm'])) {
 }
 
 echo $Twig->render('bonus/title.twig', [
-    'auth'   => $Viewer->auth(),
     'bbcode' => $BBCode,
     'label'  => $Label,
     'price'  => $Price,
     'title'  => $Item['Title'],
+    'viewer' => $Viewer,
 ]);

sections/collages/recover.php

@@ -31,5 +31,5 @@ if (!empty($_POST['id']) || $_POST['name'] !== '') {
 }
 
 echo $Twig->render('collage/recover.twig', [
-    'auth' => $Viewer->auth(),
+    'viewer' => $Viewer,
 ]);

sections/recovery/pair.php

@@ -45,10 +45,10 @@ if (isset($_POST['curr']) && isset($_POST['prev'])) {
 }
 
 echo $Twig->render('recovery/pair.twig', [
-    'auth'    => $Viewer->auth(),
     'confirm' => $confirm,
     'curr_id' => $currId,
     'prev_id' => $prevId,
     'prev'    => $prev,
     'message' => $message,
+    'viewer'  => $Viewer,
 ]);

sections/requests/edit_bounty.php

@@ -12,6 +12,6 @@ if (is_null($request)) {
 }
 
 echo $Twig->render('request/edit-bounty.twig', [
-    'auth'    => $Viewer->auth(),
     'request' => $request,
+    'viewer'  => $Viewer,
 ]);

sections/staffblog/index.php

@@ -57,9 +57,9 @@ View::show_header('Staff Blog', ['js' => 'bbcode']);
 if (in_array($_REQUEST['action'] ?? '', ['', 'editblog'])) {
     echo $Twig->render('staffblog/edit.twig', [
         'action'    => empty($_REQUEST['action']) ? 'create' : 'edit',
-        'auth'      => $Viewer->auth(),
         'blog'      => $blog ?? null,
         'show_form' => !isset($_REQUEST['action']) || $_REQUEST['action'] !== 'editblog',
+        'viewer'    => $Viewer,
     ]);
 }
 

sections/tools/data/invite_pool.php

@@ -21,14 +21,13 @@ if ($search) {
 $pending = $inviteMan->totalPending();
 
 $paginator = new Gazelle\Util\Paginator(INVITES_PER_PAGE, (int)($_GET['page'] ?? 1));
-$paginator->setTotal($inviteMan->totalPending());
+$paginator->setTotal($pending);
 
 echo $Twig->render('invite/pool.twig', [
-    'auth'      => $Viewer->auth(),
     'paginator' => $paginator,
     'list'      => $inviteMan->pendingInvites($paginator->limit(), $paginator->offset()),
     'pending'   => $pending,
     'removed'   => $removed,
     'search'    => $search,
-    'can_edit'  => $Viewer->permitted('users_edit_invites'),
+    'viewer'    => $Viewer,
 ]);

sections/tools/development/analysis_list.php

@@ -38,10 +38,15 @@ $heading = new Gazelle\Util\SortableTableHeader('updated', [
 ]);
 
 echo $Twig->render('debug/analysis-list.twig', [
-    'auth'      => $Viewer->auth(),
     'heading'   => $heading,
-    'list'      => $errMan->list($heading->getOrderBy(), $heading->getOrderDir(), $paginator->limit(), $paginator->offset()),
+    'list'      => $errMan->list(
+        $heading->getOrderBy(),
+        $heading->getOrderDir(),
+        $paginator->limit(),
+        $paginator->offset()
+    ),
     'paginator' => $paginator,
     'removed'   => $removed,
     'search'    => $_REQUEST['search'] ?? '',
+    'viewer'    => $Viewer,
 ]);

sections/tools/development/clear_cache.php

@@ -72,10 +72,10 @@ if (isset($_REQUEST['json'])) {
 }
 
 echo $Twig->render('admin/cache-management.twig', [
-    'can_flush'     => $Viewer->permitted('admin_clear_cache'),
-    'delta'         => $delta,
-    'flushed'       => $flushed,
-    'key'           => $_REQUEST['key'] ?? '',
-    'multi'         => $multi,
-    'result'        => $result,
+    'delta'   => $delta,
+    'flushed' => $flushed,
+    'key'     => $_REQUEST['key'] ?? '',
+    'multi'   => $multi,
+    'result'  => $result,
+    'viewer'  => $Viewer,
 ]);

sections/tools/development/periodic_edit.php

@@ -7,7 +7,7 @@ if (!$Viewer->permitted('admin_periodic_task_manage')) {
 }
 
 echo $Twig->render('admin/scheduler/edit.twig', [
-    'auth'      => $Viewer->auth(),
     'err'       => $err ?? null,
     'task_list' => (new Gazelle\TaskScheduler())->getTasks(),
+    'viewer'    => $Viewer,
 ]);

sections/tools/development/site_options.php

@@ -11,8 +11,8 @@ $siteOption = new Gazelle\Manager\SiteOption();
 if ($Viewer->permitted('admin_manage_permissions') && isset($_POST['submit'])) {
     authorize();
 
-    $name = trim($_POST['name']);
-    $value = trim($_POST['value']);
+    $name    = trim($_POST['name']);
+    $value   = trim($_POST['value']);
     $comment = trim($_POST['comment']);
 
     if ($_POST['submit'] == 'Delete') {
@@ -37,7 +37,6 @@ if ($Viewer->permitted('admin_manage_permissions') && isset($_POST['submit'])) {
 }
 
 echo $Twig->render('admin/site-option.twig', [
-    'auth'     => $Viewer->auth(),
-    'is_admin' => $Viewer->permitted('admin_manage_permissions'),
-    'list'     => $siteOption->list(),
+    'list'   => $siteOption->list(),
+    'viewer' => $Viewer,
 ]);

sections/tools/managers/bonus_points.php

@@ -37,7 +37,7 @@ if (isset($_REQUEST['add_points'])) {
 }
 
 echo $Twig->render('admin/bonus-points.twig', [
-    'auth'    => $Viewer->auth(),
     'message' => $message,
     'since'   =>  date("Y-m-d", strtotime("-120 day", time())),
+    'viewer'  => $Viewer,
 ]);

sections/tools/managers/categories_list.php

@@ -7,6 +7,6 @@ if (!$Viewer->permitted('admin_manage_forums')) {
 }
 
 echo $Twig->render('admin/forum-category.twig', [
-    'auth' => $Viewer->auth(),
-    'list' => (new Gazelle\Manager\ForumCategory())->usageList(),
+    'list'   => (new Gazelle\Manager\ForumCategory())->usageList(),
+    'viewer' => $Viewer,
 ]);

sections/tools/managers/create_user.php

@@ -40,5 +40,5 @@ if (isset($_POST['Username'])) {
 }
 
 echo $Twig->render('admin/user-create.twig', [
-    'auth' => $Viewer->auth(),
+    'viewer' => $Viewer,
 ]);

sections/tools/managers/db_key.php

@@ -12,7 +12,7 @@ if (isset($_POST['dbkey'])) {
 }
 
 echo $Twig->render('admin/db-key.twig', [
-    'auth'        => $Viewer->auth(),
+    'viewer'      => $Viewer,
     'fingerprint' => (apcu_exists('DB_KEY') && apcu_fetch('DB_KEY'))
         ? '0x' . substr(apcu_fetch('DB_KEY'), 0, 4)
         : false,

sections/tools/managers/dnu_list.php

@@ -7,6 +7,6 @@ if (!$Viewer->permitted('admin_dnu')) {
 }
 
 echo $Twig->render('admin/dnu.twig', [
-    'auth' => $Viewer->auth(),
-    'list' => (new Gazelle\Manager\DNU())->dnuList(),
+    'list'   => (new Gazelle\Manager\DNU())->dnuList(),
+    'viewer' => $Viewer,
 ]);

sections/tools/managers/forum_list.php

@@ -7,8 +7,8 @@ if (!$Viewer->permitted('admin_manage_forums')) {
 }
 
 echo $Twig->render('admin/forum-management.twig', [
-    'auth'       => $Viewer->auth(),
     'category'   => (new Gazelle\Manager\ForumCategory())->forumCategoryList(),
     'class_list' => (new Gazelle\Manager\User())->classList(),
     'toc'        => (new Gazelle\Manager\Forum())->tableOfContents($Viewer),
+    'viewer'     => $Viewer,
 ]);

sections/tools/managers/invite_source.php

@@ -13,6 +13,6 @@ if ($user) {
 }
 
 echo $Twig->render('admin/invite-source.twig', [
-    'auth' => $Viewer->auth(),
-    'list' => (new Gazelle\Manager\InviteSource())->summaryByInviter(),
+    'list'   => (new Gazelle\Manager\InviteSource())->summaryByInviter(),
+    'viewer' => $Viewer,
 ]);

sections/tools/managers/invite_source_config.php

@@ -20,6 +20,6 @@ if ($remove) {
 }
 
 echo $Twig->render('admin/invite-source-config.twig', [
-    'auth' => $Viewer->auth(),
-    'list' => $manager->usageList(),
+    'list'   => $manager->usageList(),
+    'viewer' => $Viewer,
 ]);

sections/tools/managers/login_watch.php

@@ -54,12 +54,11 @@ $list = $watch->activeList($headerInfo->getOrderBy(), $headerInfo->getOrderDir()
 $resolve = isset($_REQUEST['resolve']);
 
 echo $Twig->render('admin/login-watch.twig', [
-    'auth'      => $Viewer->auth(),
     'header'    => $header,
     'list'      => $list,
-    'can_ban'   => $Viewer->permitted('admin_manage_ipbans'),
     'nr_ban'    => $nrBan ?? null,
     'nr_clear'  => $nrClear ?? null,
     'paginator' => $paginator,
     'resolve'   => $resolve,
+    'viewer'    => $Viewer,
 ]);

sections/tools/managers/mass_pm.php

@@ -7,7 +7,7 @@ if (!$Viewer->permitted("admin_global_notification")) {
 }
 
 echo $Twig->render('admin/mass-pm.twig', [
-    'auth'  => $Viewer->auth(),
-    'body'  => new Gazelle\Util\Textarea('body', '', 95, 10),
-    'class' => (new Gazelle\Manager\User())->classList(),
+    'body'   => new Gazelle\Util\Textarea('body', '', 95, 10),
+    'class'  => (new Gazelle\Manager\User())->classList(),
+    'viewer' => $Viewer,
 ]);

sections/tools/managers/navigation_list.php

@@ -7,6 +7,6 @@ if (!$Viewer->permitted('admin_manage_navigation')) {
 }
 
 echo $Twig->render('admin/user-navigation.twig', [
-    'auth' => $Viewer->auth(),
-    'list' => (new Gazelle\Manager\UserNavigation())->fullList(),
+    'list'   => (new Gazelle\Manager\UserNavigation())->fullList(),
+    'viewer' => $Viewer,
 ]);

sections/tools/managers/news.php

@@ -65,10 +65,10 @@ switch ($_REQUEST['action']) {
         error('Unknown news action');
 }
 echo $Twig->render('admin/news.twig', [
-    'auth'    => $Viewer->auth(),
     'body'    => new Gazelle\Util\Textarea('body', $body),
     'create'  => $create,
     'id'      => $id,
     'title'   => $title,
     'list'    => $newsMan->headlines(),
+    'viewer'  => $Viewer,
 ]);

sections/tools/managers/staff_groups_list.php

@@ -7,6 +7,6 @@ if (!$Viewer->permitted('admin_manage_permissions')) {
 }
 
 echo $Twig->render('admin/staff-group.twig', [
-    'auth' => $Viewer->auth(),
-    'list' => (new Gazelle\Manager\StaffGroup())->groupList(),
+    'list'   => (new Gazelle\Manager\StaffGroup())->groupList(),
+    'viewer' => $Viewer,
 ]);

sections/tools/managers/tags_official.php

@@ -30,8 +30,8 @@ if ($_POST['newtag'] ?? null) {
 }
 
 echo $Twig->render('tag/official.twig', [
-    'auth'       => $Viewer->auth(),
     'list'       => $tagMan->officialList($_GET['order'] ?? 'name'),
     'new'        => $new,
     'unofficial' => $unofficialName,
+    'viewer'     => $Viewer,
 ]);

sections/tools/managers/tokens.php

@@ -26,9 +26,9 @@ if (isset($_POST['addtokens'])) {
 
 echo $Twig->render('admin/freeleech-tokens.twig', [
     'amount'         => $amount,
-    'auth'           => $Viewer->auth(),
     'fl_added'       => $flAdded,
     'fl_cleared'     => $flCleared,
     'leech_disabled' => $_POST['allowleechdisabled'] ?? true,
     'only_drop'      => $_POST['onlydrop'] ?? false,
+    'viewer'         => $Viewer,
 ]);

sections/tools/managers/whitelist_list.php

@@ -7,6 +7,6 @@ if (!$Viewer->permitted('admin_whitelist')) {
 }
 
 echo $Twig->render('admin/client-whitelist.twig', [
-    'auth' => $Viewer->auth(),
-    'list' => (new Gazelle\Manager\ClientWhitelist())->list(),
+    'list'   => (new Gazelle\Manager\ClientWhitelist())->list(),
+    'viewer' => $Viewer,
 ]);

sections/torrents/edit_group_handle.php

@@ -14,24 +14,23 @@ $tgroup = (new Gazelle\Manager\TGroup())->findById((int)$_REQUEST['groupid']);
 if (is_null($tgroup)) {
     error(404);
 }
-$GroupID = $tgroup->id();
 
 $logInfo = [];
 if (($_GET['action'] ?? '') == 'revert') {
     // we're reverting to a previous revision
-    $RevisionID = (int)$_GET['revisionid'];
-    if (!$RevisionID) {
+    $revisionId = (int)$_GET['revisionid'];
+    if (!$revisionId) {
         error('No revision specified to revert');
     }
     if (empty($_GET['confirm'])) {
-        echo $Twig->render('tgroup/revert-confirm.twig', [
-            'auth'        => $Viewer->auth(),
-            'group_id'    => $GroupID,
-            'revision_id' => $RevisionID,
+        echo $Twig->render('tgroup/confirm-revert.twig', [
+            'group_id'    => $tgroup->id(),
+            'revision_id' => $revisionId,
+            'viewer'      => $Viewer,
         ]);
         exit;
     }
-    $revert = $tgroup->revertRevision($Viewer->id(), $RevisionID);
+    $revert = $tgroup->revertRevision($Viewer->id(), $revisionId);
     if (is_null($revert)) {
         error(404);
     }
@@ -78,7 +77,7 @@ if (($_GET['action'] ?? '') == 'revert') {
     if ($_POST['summary']) {
         $logInfo[] = "summary: " . trim($_POST['summary']);
     }
-    $RevisionID = $tgroup->createRevision($Body, $Image, $_POST['summary'], $Viewer);
+    $revisionId = $tgroup->createRevision($Body, $Image, $_POST['summary'], $Viewer);
 }
 
 $imageFlush = ($Image != $tgroup->showFallbackImage(false)->image());

sections/torrents/masspm.php

@@ -11,7 +11,7 @@ if (is_null($torrent)) {
 }
 
 echo $Twig->render('torrent/masspm.twig', [
-    'auth'     => $Viewer->auth(),
     'textarea' => new Gazelle\Util\Textarea('message', '[pl]' . $torrent->id() . '[/pl]', 60, 8),
     'torrent'  => $torrent,
+    'viewer'   => $Viewer,
 ]);

sections/torrents/merge.php

@@ -25,9 +25,9 @@ if ($old->categoryName() !== 'Music') {
 // Everything is legit, ask for confirmation
 if (empty($_POST['confirm'])) {
     echo $Twig->render('torrent/confirm-merge.twig', [
-        'auth' => $Viewer->auth(),
-        'new'  => $new,
-        'old'  => $old,
+        'new'    => $new,
+        'old'    => $old,
+        'viewer' => $Viewer,
     ]);
     exit;
 }

sections/torrents/new_groupid.php

@@ -29,9 +29,9 @@ if ($torrent->groupId() === $new->id()) {
 
 if (empty($_POST['confirm'])) {
     echo $Twig->render('torrent/confirm-move.twig', [
-        'auth'    => $Viewer->auth(),
         'new'     => $new,
-        'torrent' => $torrent
+        'torrent' => $torrent,
+        'viewer'  => $Viewer,
     ]);
     exit;
 }

sections/user/seedbox_edit.php

@@ -63,8 +63,7 @@ if (isset($_POST['mode'])) {
 }
 
 echo $Twig->render('seedbox/config.twig', [
-    'auth' => $Viewer->auth(),
-    'free' => $seedbox->freeList(),
-    'host' => $seedbox->hostList(),
-    'user' => $user,
+    'seedbox' => $seedbox,
+    'user'    => $user,
+    'viewer'  => $Viewer,
 ]);

sections/user/seedbox_view.php

@@ -65,21 +65,21 @@ if ($source && $target) {
             $paginator->limit(),
             $paginator->offset()
         ),
-        'auth'      => $Viewer->auth(),
         'mode'      => $union ? 'union' : 'exclude',
         'paginator' => $paginator,
         'seedbox'   => $seedbox,
         'source_id' => $source,
         'target_id' => $target,
         'user_id'   => $userId,
+        'viewer'    => $Viewer,
     ]);
 }
 
 echo $Twig->render('seedbox/view.twig', [
-    'auth'    => $Viewer->auth(),
     'mode'    => $union ? 'union' : 'exclude',
     'seedbox' => $seedbox,
     'source'  => $source,
     'target'  => $target,
     'user_id' => $userId,
+    'viewer'  => $Viewer,
 ]);

sections/userhistory/token_history.php

@@ -33,10 +33,8 @@ $paginator = new Gazelle\Util\Paginator(25, (int)($_GET['page'] ?? 1));
 $paginator->setTotal($user->stats()->flTokenTotal());
 
 echo $Twig->render('user/history-freeleech.twig', [
-    'admin'       => $Viewer->permitted('admin_fl_history'),
-    'auth'        => $Viewer->auth(),
-    'list'        => $user->tokenList($torMan, $paginator->limit(), $paginator->offset()),
-    'own_profile' => $Viewer->id() == $user->id(),
-    'paginator'   => $paginator,
-    'user'        => $user,
+    'list'      => $user->tokenList($torMan, $paginator->limit(), $paginator->offset()),
+    'paginator' => $paginator,
+    'user'      => $user,
+    'viewer'    => $Viewer,
 ]);

templates/admin/bonus-points.twig

@@ -18,7 +18,7 @@
         <label for="seed_points"> Add points for people who have been seeding now.</label><br /><br />
 
         <input type="hidden" name="action" value="bonus_points" />
-        <input type="hidden" name="auth" value="{{ auth }}" />
+        <input type="hidden" name="auth" value="{{ viewer.auth }}" />
         <input type="submit" name="add_points" value="Add bonus points" />
     </form>
 </div>

templates/admin/cache-management.twig

@@ -56,13 +56,13 @@
         <textarea cols="80" rows="8" name="key" id="key" class="inputtext">{{ key }}</textarea><br />
         <span style="padding: 0 0"><input type="submit" name="view" value="View" /></span>
         <span style="padding: 0 20px"><input type="submit" name="json" value="View as JSON" /></span>
-{% if can_flush %}
+{% if viewer.permitted('admin_clear_cache') %}
         <label><input type="checkbox" name="check" /> Confirm</label>
         <input type="submit" name="flush" value="Flush keys" />
 {% endif %}
     </form>
     </div>
-{% if can_flush %}
+{% if viewer.permitted('admin_clear_cache') %}
     <div class="box pad">
     <h2>Bulk Eraser</h2>
         <p>Flush collections. Warning: may be so slow as to cause a gateway timeout, but the process will complete.</p>
@@ -104,7 +104,7 @@
                 <td colspan="{{ constant('CACHE_NAMESPACE')|length }}">
                     <form class="delete_form" name="cache" action="" method="post">
                         <input type="hidden" name="action" value="clear_cache" />
-                        <input type="hidden" name="auth" value="{{ auth }}" />
+                        <input type="hidden" name="auth" value="{{ viewer.auth }}" />
                         <input type="hidden" name="global_flush" value="1" />
 
                         <p>Full restart (all keys will be flushed!)</p>

templates/admin/client-whitelist.twig

@@ -5,7 +5,7 @@
 <div class="box2 pad thin">
 <form class="add_form" name="clients" action="" method="post">
     <input type="hidden" name="action" value="whitelist_alter" />
-    <input type="hidden" name="auth" value="{{ auth }}" />
+    <input type="hidden" name="auth" value="{{ viewer.auth }}" />
     <table>
         <tr class="colhead">
             <td colspan="4">Add client</td>
@@ -33,7 +33,7 @@
 {% for c in list %}
 <form class="manage_form" name="clients" action="" method="post">
     <input type="hidden" name="action" value="whitelist_alter" />
-    <input type="hidden" name="auth" value="{{ auth }}" />
+    <input type="hidden" name="auth" value="{{ viewer.auth }}" />
     <table>
         <tr class="row{{ cycle(['a', 'b'], loop.index0) }}">
             <td>

templates/admin/db-key.twig

@@ -7,7 +7,7 @@
     <form class="create_form" name="db_key" method="post" action="">
         <div class="pad">
             <input type="hidden" name="action" value="dbkey" />
-            <input type="hidden" name="auth" value="{{ auth }}" />
+            <input type="hidden" name="auth" value="{{ viewer.auth }}" />
             <input type="text" name="dbkey" class="inputtext" /> <br />
             <div class="center">
                 <input type="submit" name="submit" value="Update Key" class="submit" />

templates/admin/dnu.twig

@@ -10,7 +10,7 @@
     <tr class="rowa">
         <form class="add_form" name="dnu" action="tools.php" method="post">
             <input type="hidden" name="action" value="dnu_alter" />
-            <input type="hidden" name="auth" value="{{ auth }}" />
+            <input type="hidden" name="auth" value="{{ viewer.auth }}" />
             <td>
                 <input type="text" name="name" size="40" />
             </td>
@@ -34,7 +34,7 @@
         <form class="manage_form dnu" action="tools.php" method="post">
         <td>
             <input type="hidden" name="action" value="dnu_alter" />
-            <input type="hidden" name="auth" value="{{ auth }}" />
+            <input type="hidden" name="auth" value="{{ viewer.auth }}" />
             <input type="hidden" name="id" value="{{ item.id_do_not_upload }}" />
             <input type="text" name="name" value="{{ item.name }}" size="40" />
         </td>

templates/admin/forum-category.twig

@@ -19,7 +19,7 @@
     <form class="manage_form" name="forums" action="" method="post">
         <input type="hidden" name="id" value="{{ cat.id }}" />
         <input type="hidden" name="action" value="categories_alter" />
-        <input type="hidden" name="auth" value="{{ auth }}" />
+        <input type="hidden" name="auth" value="{{ viewer.auth }}" />
         <td>
             <input type="text" size="3" name="sort" value="{{ cat.sequence }}" />
         </td>
@@ -45,7 +45,7 @@
     <tr class="rowa">
         <form class="create_form" name="forum" action="" method="post">
             <input type="hidden" name="action" value="categories_alter" />
-            <input type="hidden" name="auth" value="{{ auth }}" />
+            <input type="hidden" name="auth" value="{{ viewer.auth }}" />
             <td>
                 <input type="text" size="3" name="sort" />
             </td>

templates/admin/forum-management.twig

@@ -27,7 +27,7 @@
         <form class="manage_form" name="forums" action="" method="post">
             <input type="hidden" name="id" value="{{ forum.id }}>" />
             <input type="hidden" name="action" value="forum_alter" />
-            <input type="hidden" name="auth" value="{{ auth }}" />
+            <input type="hidden" name="auth" value="{{ viewer.auth }}" />
             <td>
                 <select name="categoryid">
         {% for id, name in category %}
@@ -69,7 +69,7 @@
     <tr class="rowa">
         <form class="create_form" name="forum" action="" method="post">
             <input type="hidden" name="action" value="forum_alter" />
-            <input type="hidden" name="auth" value="{{ auth }}" />
+            <input type="hidden" name="auth" value="{{ viewer.auth }}" />
             <td>
                 <select name="categoryid">
 {% for id, name in category %}

templates/admin/freeleech-tokens.twig

@@ -29,7 +29,7 @@ to {{ fl_added|number_format }} enabled users
         Tokens to add: <input type="text" name="numtokens" size="{{ amount }}" /><br /><br />
 
         <input type="hidden" name="action" value="tokens" />
-        <input type="hidden" name="auth" value="{{ auth }}" />
+        <input type="hidden" name="auth" value="{{ viewer.auth }}" />
         <input type="submit" name="addtokens" value="Add tokens" />
     </form>
 </div>
@@ -50,7 +50,7 @@ to {{ fl_added|number_format }} enabled users
         Members with more tokens will have their total reduced to this limit.<br /><br />
 
         <input type="hidden" name="action" value="tokens" />
-        <input type="hidden" name="auth" value="{{ auth }}" />
+        <input type="hidden" name="auth" value="{{ viewer.auth }}" />
         <input type="submit" name="cleartokens" value="Set maximum token limit" />
     </form>
 </div>

templates/admin/invite-source-config.twig

@@ -36,7 +36,7 @@
     New name: <input type="text" length="40" name="name" />
     <br />
     <br />
-    <input type="hidden" name="auth" value="{{ auth }}" />
+    <input type="hidden" name="auth" value="{{ viewer.auth }}" />
     <input type="hidden" name="action" value="invite_source_config" />
     <input type="submit" value="Update" />
     </form>

templates/admin/invite-source.twig

@@ -30,7 +30,7 @@
     <h3>No inviters have been configured</h3>
 {% endfor %}
     <br />
-    <input type="hidden" name="auth" value="{{ auth }}" />
+    <input type="hidden" name="auth" value="{{ viewer.auth }}" />
     <input type="hidden" name="action" value="invite_source" />
     Go to user page to edit sources (user id or @name): <input type="text" length="40" name="user" /> <input type="submit" value="Go!" />
     </form>

templates/admin/login-watch.twig

@@ -29,7 +29,7 @@
 {% for b in list %}
     {% if loop.first %}
 <form class="manage_form" name="bans" action="" method="post">
-<input type="hidden" name="auth" value="{{ auth }}" />
+<input type="hidden" name="auth" value="{{ viewer.auth }}" />
 <input type="hidden" name="action" value="login_watch" />
 <table width="100%">
     <tr class="colhead">
@@ -41,7 +41,7 @@
         <td>{{ header.last_attempt|raw }}</td>
         <td>{{ header.banned_until|raw }}</td>
         <td>Clear</td>
-        {% if can_ban %}
+        {% if viewer.permitted('admin_manage_ipbans') %}
         <td>Ban</td>
         {% endif %}
         <td>Do nothing</td>
@@ -79,7 +79,7 @@
         <td style="text-align: center">
             <input type="radio" title="clear" name="admin-{{ b.id }}" value="clear" />
         </td>
-    {% if can_ban %}
+    {% if viewer.permitted('admin_manage_ipbans') %}
         <td style="text-align: center">
             <input type="radio" title="ban" name="admin-{{ b.id }}" value="ban" />
         </td>
@@ -88,7 +88,7 @@
             <input type="radio" title="no change" id="noop-{{ b.id }}" name="admin-{{ b.id }}" value="noop" checked="checked" />
         </td>
     {% if loop.last %}
-        {% if can_ban %}
+        {% if viewer.permitted('admin_manage_ipbans') %}
     <tr>
         <td><br />Ban Reason</td>
         <td colspan="9">

templates/admin/mass-pm.twig

@@ -6,7 +6,7 @@
 <form class="send_form" name="message" action="tools.php" method="post" id="messageform">
     <div class="box pad">
         <input type="hidden" name="action" value="take_mass_pm" />
-        <input type="hidden" name="auth" value="{{ auth }}" />
+        <input type="hidden" name="auth" value="{{ viewer.auth }}" />
         <div id="quickpost">
             <h3>Class</h3>
             <select id="class_id" name="class_id">

templates/admin/news.twig

@@ -7,7 +7,7 @@
     <form class="{% if create %}create_form{% else %}edit_form{% endif %}" name="news_post" action="tools.php" method="post">
         <div class="box pad">
             <input type="hidden" name="action" value="{% if create %}takenewnews{% else %}takeeditnews{% endif %}" />
-            <input type="hidden" name="auth" value="{{ auth }}" />
+            <input type="hidden" name="auth" value="{{ viewer.auth }}" />
 {% if id %}
             <input type="hidden" name="id" value="{{ id }}" />
 {% endif %}
@@ -32,7 +32,7 @@
         <div class="head">
             <strong>{{ article.title }}</strong> - posted {{ article.created|time_diff }}
             - <a href="tools.php?action=editnews&amp;id={{ article.id }}" class="brackets">Edit</a>
-            <a href="tools.php?action=deletenews&amp;id={{ article.id }}&amp;auth={{ auth }}" class="brackets">Delete</a>
+            <a href="tools.php?action=deletenews&amp;id={{ article.id }}&amp;auth={{ viewer.auth }}" class="brackets">Delete</a>
         </div>
         <div class="pad">{{ article.body|bb_format }}</div>
     </div>

templates/admin/scheduler/edit.twig

@@ -24,7 +24,7 @@
             <input type="hidden" name="id" value="{{ t.periodic_task_id }}" />
             <input type="hidden" name="action" value="periodic" />
             <input type="hidden" name="mode" value="alter" />
-            <input type="hidden" name="auth" value="{{ auth }}" />
+            <input type="hidden" name="auth" value="{{ viewer.auth }}" />
             <td>
                 <input type="text" size="15" name="name" value="{{ t.name }}" />
             </td>
@@ -60,7 +60,7 @@
         <form class="create_form" name="accounts" action="" method="post">
             <input type="hidden" name="action" value="periodic" />
             <input type="hidden" name="mode" value="alter" />
-            <input type="hidden" name="auth" value="{{ auth }}" />
+            <input type="hidden" name="auth" value="{{ viewer.auth }}" />
             <td>
                 <input type="text" size="10" name="name" />
             </td>

templates/admin/site-option.twig

@@ -7,12 +7,12 @@
         <td>Name</td>
         <td>Value</td>
         <td>Comment</td>
-{% if is_admin %}
+{% if viewer.permitted('admin_manage_permissions') %}
         <td>Manage</td>
 {% endif %}
     </tr>
 
-{% if is_admin %}
+{% if viewer.permitted('admin_manage_permissions') %}
     <tr class="rowa">
         <form class="create_form" name="site_option" action="" method="post">
             <td title="Words must be separated by dashes or underscores">
@@ -26,7 +26,7 @@
             </td>
             <td>
                 <input type="hidden" name="action" value="site_options" />
-                <input type="hidden" name="auth" value="{{ auth }}" />
+                <input type="hidden" name="auth" value="{{ viewer.auth }}" />
                 <input type="submit" name="submit" value="Create" />
             </td>
         </form>
@@ -35,14 +35,14 @@
 
 {% for opt in list %}
     <tr class="row{{ cycle(['a', 'b'], loop.index0) }}">
-    {% if is_admin %}
+    {% if viewer.permitted('admin_manage_permissions') %}
     <form class="manage_form" name="site_option" action="" method="post">
         <td><input type="text" size="25" name="name" value="{{ opt.name }}" /></td>
         <td><input type="text" size="6" name="value" value="{{ opt.value }}" /></td>
         <td><input type="text" size="60" name="comment" value="{{ opt.comment }}" /></td>
         <td>
             <input type="hidden" name="action" value="site_options" />
-            <input type="hidden" name="auth" value="{{ auth }}" />
+            <input type="hidden" name="auth" value="{{ viewer.auth }}" />
             <input type="hidden" name="id" value="{{ opt.id }}" />
             <input type="submit" name="submit" value="Edit" />
             <input type="submit" name="submit" value="Delete" />

templates/admin/staff-group.twig

@@ -17,7 +17,7 @@
         <form class="manage_form" name="accounts" action="" method="post">
             <input type="hidden" name="id" value="{{ g.id }}" />
             <input type="hidden" name="action" value="staff_groups_alter" />
-            <input type="hidden" name="auth" value="{{ auth }}" />
+            <input type="hidden" name="auth" value="{{ viewer.auth }}" />
             <td>
                 <input type="text" size="10" name="sort" value="{{ g.sequence }}" />
             </td>
@@ -37,7 +37,7 @@
     <tr class="rowa">
         <form class="create_form" name="groups" action="" method="post">
             <input type="hidden" name="action" value="staff_groups_alter" />
-            <input type="hidden" name="auth" value="{{ auth }}" />
+            <input type="hidden" name="auth" value="{{ viewer.auth }}" />
             <td>
                 <input type="text" size="10" name="sort" />
             </td>

templates/admin/user-create.twig

@@ -6,7 +6,7 @@
 <div class="thin box pad">
 <form class="create_form" name="user" method="post" action="">
     <input type="hidden" name="action" value="create_user" />
-    <input type="hidden" name="auth" value="{{ auth }}" />
+    <input type="hidden" name="auth" value="{{ viewer.auth }}" />
     <table class="layout" cellpadding="2" cellspacing="1" border="0" align="center">
         <tr valign="top">
             <td align="right" class="label">Username:</td>

templates/admin/user-navigation.twig

@@ -19,7 +19,7 @@
     <form class="manage_form" name="navitems" action="" method="post">
         <input type="hidden" name="id" value="{{ item.id }}" />
         <input type="hidden" name="action" value="navigation_alter" />
-        <input type="hidden" name="auth" value="{{ auth }}" />
+        <input type="hidden" name="auth" value="{{ viewer.auth }}" />
         <td>
             <input type="text" name="tag" value="{{ item.tag }}" />
         </td>
@@ -54,7 +54,7 @@
     <tr class="rowa">
     <form class="manage_form" name="navitems" action="" method="post">
         <input type="hidden" name="action" value="navigation_alter" />
-        <input type="hidden" name="auth" value="{{ auth }}" />
+        <input type="hidden" name="auth" value="{{ viewer.auth }}" />
         <td>
             <input type="text" name="tag" />
         </td>

templates/artist/collage-add.twig

@@ -3,15 +3,15 @@
         <div class="pad">
             <form id="add-to-collage" action="collages.php" method="post">
 {% for collage in collage_list %}
-    {% if loop.first %}
+{%  if loop.first %}
             <select style="max-width: 100%" name="collage_combo" id="collage-select">
                 <option value="0">Choose recent...</option>
-    {% endif %}
+{%  endif %}
                 <option value="{{ collage.id }}">{{ collage.name }}</option>
-    {% if loop.last %}
+{%  if loop.last %}
             </select>
             <div>or search for collage name or URL:</div>
-    {% endif %}
+{%  endif %}
 {% else %}
             <div>Search for a collage name or URL:</div>
 {% endfor %}

templates/bonus/title.twig

@@ -10,7 +10,7 @@
         <tr>
             <td>
                 <form action="bonus.php?action=purchase&label={{ label }}" method="post">
-                    <input type="hidden" name="auth" value="{{ auth }}" />
+                    <input type="hidden" name="auth" value="{{ viewer.auth }}" />
                     <input type="hidden" name="confirm" value="true" />
                     <input type="text" style="width: 98%" id="title" name="title" placeholder="Custom Title"/> <br />
                     <input type="submit" onclick="ConfirmPurchase(event, '{{ title }}')" value="Submit" />&nbsp;<input type="button" onclick="PreviewTitle({{ bbcode }});" value="Preview" /><br /><br />
@@ -21,6 +21,4 @@
         </tbody>
     </table>
 </div>
-
 {{ footer() }}
-

templates/collage/recover.twig

@@ -7,7 +7,7 @@
         <div class="pad">
             <form class="undelete_form" name="collage" action="collages.php" method="post">
                 <input type="hidden" name="action" value="recover" />
-                <input type="hidden" name="auth" value="{{ auth }}" />
+                <input type="hidden" name="auth" value="{{ viewer.auth }}" />
                 <div class="field_div">
                     <strong>Collage ID: </strong>
                     <input type="text" name="id" size="8" />

templates/contest/admin-form.twig

@@ -131,7 +131,7 @@
     </table>
     </div>
     <input type="hidden" name="userid" value="{{ user_id }}"/>
-    <input type="hidden" name="auth" value="{{ auth }}"/>
+    <input type="hidden" name="auth" value="{{ viewer.auth }}"/>
 {% if create %}
     <input type="hidden" name="new" value="1"/>
     <input type="submit" id="submit" value="Create contest"/>

templates/contest/admin.twig

@@ -1,5 +1,4 @@
 {{ header('contest admin') }}
-
 <div class="thin">
     <div class="header">
         <h2>Contest admin</h2>
@@ -19,20 +18,21 @@
 {% endif %}
 
 {% if not create %}
-    {% include 'contest/list.twig' with {
-        'viewer':  viewer,
-        'current': contest,
-        'list':    list,
-        'type':    type,
-        } only
-    %}
+{%  include 'contest/list.twig'
+    with {
+        'current' : contest,
+        'list'    : list,
+        'type'    : type,
+        'viewer'  : viewer,
+    } only
+%}
 {% endif %}
 
 {% if contest is request_fill %}
     <div class="box pad">
         <h2>Request pairs</h2>
-    {% for pair in contest.requestPairs %}
-        {% if loop.first %}
+{%  for pair in contest.requestPairs %}
+{%      if loop.first %}
         <p>The following members have filled out more than one request for the same member.</p>
         <table>
             <tr class="colhead">
@@ -40,33 +40,35 @@
                 <td>Request creator</td>
                 <td>Filled</td>
             </tr>
-        {% endif %}
+{%      endif %}
             <tr>
                 <td>{{ pair.FillerID|user_url }}</td>
                 <td>{{ pair.UserID|user_url }}</td>
                 <td>{{ pair.nr|number_format }}</td>
             </tr>
-        {% if loop.last %}
+{%      if loop.last %}
         </table>
-        {% endif %}
-    {% else %}
+{%      endif %}
+{%  else %}
         <p>No members have filled out more than one request for the same member.</p>
-    {% endfor %}
+{%  endfor %}
     </div>
 {% endif %}
 
 {% if create or contest %}
-    {% include 'contest/admin-form.twig' with {
-        'action':     create ? 'contest.php?action=create' : 'contest.php?action=admin&id=' ~ contest.id,
-        'auth':       viewer.auth,
-        'contest':    contest,
-        'create':     create,
-        'type':       type,
-        'intro':      intro,
-        'user_count': user_count,
+{%   include 'contest/admin-form.twig'
+     with {
+        'action'     : create
+            ? 'contest.php?action=create'
+            : 'contest.php?action=admin&id=' ~ contest.id,
+        'contest'    : contest,
+        'create'     : create,
+        'type'       : type,
+        'intro'      : intro,
+        'user_count' : user_count,
+        'viewer'     : viewer,
     } only
-    %}
+%}
 {% endif %}
-
 </div>
 {{ footer() }}

templates/debug/analysis-list.twig

@@ -15,7 +15,7 @@
 {{ removed }} case{{ removed|plural }} removed.
 </div>
 {% endif %}
-<input type="hidden" name="auth" value="{{ auth }}" />
+<input type="hidden" name="auth" value="{{ viewer.auth }}" />
 <input type="hidden" name="action" value="analysis_list" />
 <table width="100%">
     <tr class="colhead">

templates/index/page-header.twig

@@ -4,9 +4,8 @@
 {% macro active_class(t) %}
 {%-  if t %} active{% endif -%}
 {% endmacro -%}
-{% set auth = user.auth -%}
 </head>
-<body data-id="{{ user.id }}" data-auth="{{ auth }}" id="{% if document == 'collages' %}collage{% else %}{{ document }}{% endif %}">
+<body data-id="{{ viewer.id }}" data-auth="{{ viewer.auth }}" id="{% if document == 'collages' %}collage{% else %}{{ document }}{% endif %}">
 <form id="extra-hidden">
 <input id="extracb1" class="hidden" type="checkbox">
 <input id="extracb2" class="hidden" type="checkbox">
@@ -20,17 +19,17 @@
 <div id="logo"><a href="index.php"></a></div>
 <div id="userinfo">
 <ul id="userinfo_username">
-    <li id="nav_userinfo" {{ _self.active(document == 'user' and request.id == user.id) }}>
-        <a href="user.php?id={{ user.id }}" class="username">{{ user.username }}</a>
+    <li id="nav_userinfo" {{ _self.active(document == 'user' and request.id == viewer.id) }}>
+        <a href="user.php?id={{ viewer.id }}" class="username">{{ viewer.username }}</a>
     </li>
     <li id="nav_userclass">
-        <span class="hidden userclass">{{ user.userclassName }}</span>
+        <span class="hidden userclass">{{ viewer.userclassName }}</span>
     </li>
     <li id="nav_useredit" class="brackets{{ _self.active_class(document == 'user' and action =='edit') }}">
-        <a href="user.php?action=edit&amp;id={{ user.id }}">Settings</a>
+        <a href="user.php?action=edit&amp;id={{ viewer.id }}">Settings</a>
     </li>
     <li id="nav_logout" class="brackets">
-        <a href="logout.php?auth={{ auth }}">Logout</a>
+        <a href="logout.php?auth={{ viewer.auth }}">Logout</a>
     </li>
 </ul>
 <ul id="userinfo_major">
@@ -39,11 +38,11 @@
     </li>
     <li id="nav_bonus" class="brackets{{ _self.active_class(document == 'user' and action == 'bonus') }}">
         <a href="bonus.php" class='tooltip' title="BP/hour: {{
-            bonus.hourlyRate|number_format(3) }}">Bonus ({{ user.bonusPointsTotal|number_format }})</a>
+            bonus.hourlyRate|number_format(3) }}">Bonus ({{ viewer.bonusPointsTotal|number_format }})</a>
     </li>
     <li id="nav_invite" class="brackets{{ _self.active_class(document == 'user' and action == 'invite') }}">
         <a href="user.php?action=invite" class='tooltip' title="Invite a friend!">Invite
-        {% if user.permitted('site_send_unlimited_invites') %} (∞){% elseif user.unusedInviteTotal %} ({{ user.unusedInviteTotal }}){% endif %}</a>
+        {% if viewer.permitted('site_send_unlimited_invites') %} (∞){% elseif viewer.unusedInviteTotal %} ({{ viewer.unusedInviteTotal }}){% endif %}</a>
     </li>
     <li id="nav_donate" class="brackets{{ _self.active_class(document == 'donate') }}">
         <a href="donate.php" class='tooltip' title="Donate">Donate ({{ dono_target }}%)</a>
@@ -51,15 +50,15 @@
 </ul>
 <ul id="userinfo_stats">
     <li id="stats_seeding">
-        <a href="torrents.php?type=seeding&amp;userid={{ user.id }}">Up</a>:
-        <span class="stat tooltip" title="{{ user.uploadedSize|octet_size(5) }}">{{ user.uploadedSize|octet_size }}</span>
+        <a href="torrents.php?type=seeding&amp;userid={{ viewer.id }}">Up</a>:
+        <span class="stat tooltip" title="{{ viewer.uploadedSize|octet_size(5) }}">{{ viewer.uploadedSize|octet_size }}</span>
     </li>
     <li id="stats_leeching">
-        <a href="torrents.php?type=leeching&amp;userid={{ user.id }}">Down</a>:
-        <span class="stat tooltip" title="{{ user.downloadedSize|octet_size(5) }}">{{ user.downloadedSize|octet_size }}</span>
+        <a href="torrents.php?type=leeching&amp;userid={{ viewer.id }}">Down</a>:
+        <span class="stat tooltip" title="{{ viewer.downloadedSize|octet_size(5) }}">{{ viewer.downloadedSize|octet_size }}</span>
     </li>
     <li id="stats_ratio">
-        Ratio: <span class="stat">{{ ratio(user.uploadedSize, user.downloadedSize) }}</span>
+        Ratio: <span class="stat">{{ ratio(viewer.uploadedSize, viewer.downloadedSize) }}</span>
     </li>
 {% set required_ratio = viewer.requiredRatio %}
 {% if required_ratio > 0 %}
@@ -68,11 +67,11 @@
         <span class="stat tooltip" title="{{ required_ratio|number_format(5) }}">{{ required_ratio|number_format(2) }}</span>
     </li>
 {% endif %}
-{% if user.tokenCount %}
+{% if viewer.tokenCount %}
     <li id="fl_tokens">
         <a href="wiki.php?action=article&amp;id=57">Tokens</a>:
         <span class="stat">
-            <a href="userhistory.php?action=token_history&amp;userid={{ user.id }}">{{ user.tokenCount|number_format }}</a>
+            <a href="userhistory.php?action=token_history&amp;userid={{ viewer.id }}">{{ viewer.tokenCount|number_format }}</a>
         </span>
     </li>
 {% endif %}
@@ -117,7 +116,7 @@
     <span class="hidden">Artist: </span>
     <form class="search_form" name="artists" action="artist.php" method="get">
         <input id="artistsearch"
-            {%- if user.hasAutocomplete('search') %} data-gazelle-autocomplete="true" {% endif -%}
+            {%- if viewer.hasAutocomplete('search') %} data-gazelle-autocomplete="true" {% endif -%}
             value="Artists" placeholder="Artists" type="text" name="artistname" size="17" spellcheck="false" accesskey="a" />
     </form>
 </li>
@@ -125,7 +124,7 @@
     <span class="hidden">Collage: </span>
     <form class="search_form" name="collages" action="collages.php" method="get">
         <input id="collagesearch"
-            {%- if user.hasAutocomplete('search') %} data-gazelle-autocomplete="true" {% endif -%}
+            {%- if viewer.hasAutocomplete('search') %} data-gazelle-autocomplete="true" {% endif -%}
             value="Collages" placeholder="Collages" type="text" name="search" size="17" spellcheck="false" accesskey="c" />
     </form>
 </li>

templates/invite/pool.twig

@@ -28,7 +28,7 @@
 </div>
 
 {% for invite in list %}
-    {% if loop.first %}
+{%  if loop.first %}
     {{ paginator.linkbox|raw }}
 <table width="100%">
     <tr class="colhead">
@@ -37,11 +37,11 @@
         <td>IP address</td>
         <td>Invite link</td>
         <td>Expires</td>
-    {% if can_edit %}
+{%      if viewer.permitted('users_edit_invites') %}
         <td>Controls</td>
-    {% endif %}
+{%      endif %}
     </tr>
-    {% endif %}
+{%  endif %}
 
     <tr class="row{{ cycle(['a', 'b'], loop.index0) }}">
         <td>{{ invite.user_id|user_full }}</td>
@@ -49,21 +49,21 @@
         <td>{{ ipaddr(invite.ipaddr) }}</td>
         <td><a href="register.php?invite={{ invite.key }}">{{ invite.key }}</a></td>
         <td>{{ invite.expires|time_diff }}</td>
-    {% if can_edit %}
+{%  if viewer.permitted('users_edit_invites') %}
         <td>
             <form class="delete_form" name="invite" action="" method="post">
                 <input type="hidden" name="action" value="invite_pool" />
-                <input type="hidden" name="auth" value="{{ auth }}" />
+                <input type="hidden" name="auth" value="{{ viewer.auth }}" />
                 <input type="hidden" name="invitekey" value="{{ invite.key }}" />
                 <input type="submit" value="Delete" />
             </form>
         </td>
-    {% endif %}
+{%  endif %}
     </tr>
 
-    {% if loop.last %}
+{%  if loop.last %}
 </table>
-    {{ paginator.linkbox|raw }}
-    {% endif %}
+{{ paginator.linkbox|raw }}
+{%  endif %}
 {% endfor %}
 {{ footer() }}

templates/recovery/pair.twig

@@ -69,7 +69,7 @@
 
     <input type="hidden" name="curr" value="{{ curr_id }}" />
     <input type="hidden" name="prev" value="{{ prev_id }}" />
-    <input type="hidden" name="auth" value="{{ auth }}" />
+    <input type="hidden" name="auth" value="{{ viewer.auth }}" />
     </form>
 </div>
 {% endif %}
@@ -93,7 +93,7 @@
                 <td><input type="text" name="prev" width="10" value="{{ prev_id }}" /></td>
             </tr>
         </table>
-        <input type="hidden" name="auth" value="{{ auth }}" />
+        <input type="hidden" name="auth" value="{{ viewer.auth }}" />
         <input type="submit" value="Pair" />
         </form>
     </div>

templates/request/edit-bounty.twig

@@ -24,7 +24,7 @@
         <form action="" method="post" id="request_form">
             <div>
                 <input type="hidden" name="id" value="{{ request.id }}" />
-                <input type="hidden" name="auth" value="{{ auth }}" />
+                <input type="hidden" name="auth" value="{{ viewer.auth }}" />
                 <input type="hidden" name="action" value="takebounty" />
             </div>
 

templates/seedbox/config.twig

@@ -24,16 +24,13 @@
 </div>
 
 <div class="box pad">
-{% if host is empty %}
-    No seed locations are reporting. Are your clients seeding and connected?
-{% else %}
+{% for h in seedbox.hostList %}
+{%  if loop.first %}
     <h3>Seeding locations</h3>
-{%  for h in host %}
-{%      if loop.first %}
     <form class="manage_form" name="seedbox" action="user.php?action=seedbox&amp;userid={{ user.id }}" method="post">
         <input type="hidden" name="action" value="seedbox" />
         <input type="hidden" name="mode" value="update" />
-        <input type="hidden" name="auth" value="{{ auth }}" />
+        <input type="hidden" name="auth" value="{{ viewer.auth }}" />
         <input type="hidden" name="userid" value="{{ user.id }}" />
         <table>
         <tr>
@@ -42,7 +39,7 @@
             <th>Useragent</th>
             <th>Total seeding</th>
         </tr>
-{%      endif %}
+{%  endif %}
         <tr>
             <td>
                 <input type="text" name="name-{{ loop.index }}" size="40" maxlen="40" value="{{ h.name }}" />
@@ -59,16 +56,17 @@
             </td>
             <td>{{ h.total|number_format }}</td>
         </tr>
-{%      if loop.last %}
+{%  if loop.last %}
         </table>
         <input type="submit" value="Update names" />
     </form>
-{%      endif %}
-{%  endfor %}
-{% endif %}
+{%  endif %}
+{% else %}
+    No seed locations are reporting. Are your clients seeding and connected?
+{% endfor %}
 </div>
 
-{% for f in free %}
+{% for f in seedbox.freeList %}
 {%  if loop.first %}
 <div class="box pad">
     <h3>Unused names</h3>
@@ -79,7 +77,7 @@
     <form class="manage_form" name="seedbox" action="user.php?action=seedbox&amp;userid={{ user.id }}" method="post">
         <input type="hidden" name="action" value="seedbox" />
         <input type="hidden" name="mode" value="remove" />
-        <input type="hidden" name="auth" value="{{ auth }}" />
+        <input type="hidden" name="auth" value="{{ viewer.auth }}" />
         <input type="hidden" name="userid" value="{{ user.id }}" />
     <ul class="stats nobullet">
 {%  endif %}

templates/seedbox/view.twig

@@ -13,7 +13,7 @@
 {% else %}
     <form class="manage_form" name="seedbox" action="user.php?action=seedbox-view&amp;userid={{ user_id }}" method="post">
         <input type="hidden" name="action" value="seedbox-view" />
-        <input type="hidden" name="auth" value="{{ auth }}" />
+        <input type="hidden" name="auth" value="{{ viewer.auth }}" />
         <input type="hidden" name="userid" value="{{ user_id }}" />
 
 <div>View seeds on&nbsp;

templates/staffblog/edit.twig

@@ -9,7 +9,7 @@
     <form class="{{ action }}_form" name="blog_post" action="staffblog.php" method="post">
         <div id="postform" class="pad{{ show_form ? ' hidden' : '' }}">
             <input type="hidden" name="action" value="{{ action == 'create' ? 'takenewblog' : 'takeeditblog' }}" />
-            <input type="hidden" name="auth" value="{{ auth }}" />
+            <input type="hidden" name="auth" value="{{ viewer.auth }}" />
 {% if action == 'edit' %}
             <input type="hidden" name="id" value="{{ blog.id }}" />
 {% endif %}

templates/tag/official.twig

@@ -26,7 +26,7 @@
     <div class="thin box">
         <form class="manage_form" name="tags" method="post">
             <input type="hidden" name="action" value="tags_official" />
-            <input type="hidden" name="auth" value="{{ auth }}" />
+            <input type="hidden" name="auth" value="{{ viewer.auth }}" />
             <table class="tags_table layout">
                 <tr class="colhead_dark">
 {% for col in range(1, constant('TAG_OFFICIAL_COLUMNS')) %}

templates/tgroup/confirm-revert.twig

@@ -6,7 +6,7 @@
 <div class="box pad">
     <form class="confirm_form" name="torrent_group" action="torrents.php" method="get">
         <input type="hidden" name="action" value="revert" />
-        <input type="hidden" name="auth" value="{{ auth }}" />
+        <input type="hidden" name="auth" value="{{ viewer.auth }}" />
         <input type="hidden" name="confirm" value="true" />
         <input type="hidden" name="groupid" value="{{ group_id }}" />
         <input type="hidden" name="revisionid" value="{{ revision_id }}" />

templates/tgroup/stats.twig

@@ -1,28 +1,28 @@
 {% from 'macro/rank.twig' import css_rank %}
 {% if tgroup.categoryName == 'Music' %}
-    {% if viewer.permitted('site_collages_manage') or viewer.activePersonalCollages %}
+{%  if viewer.permitted('site_collages_manage') or viewer.activePersonalCollages %}
         {% include 'torrent/collage-add.twig' with {
-            'collage_list': collage_list,
-            'tgroup_id': tgroup.id,
-            'viewer': viewer
+            'collage_list' : collage_list,
+            'tgroup_id'    : tgroup.id,
+            'viewer'       : viewer,
             } only
         %}
-    {% endif %}
+{%  endif %}
 
-    {% for key, r in vote.ranking(tgroup, viewer.permitted('site_advanced_top10')) %}
-        {% if loop.first %}
+{%  for key, r in vote.ranking(tgroup, viewer.permitted('site_advanced_top10')) %}
+{%      if loop.first %}
 <div class="box" id="votes_ranks">
     <div class="head"><strong>{{ constant('SITE_NAME') }} Favorites</strong></div>
     <div class="vote_charts body">
         <ul class="stats nobullet" id="vote_rankings">
-        {% endif %}
+{%      endif %}
             <li id="vote_rank_{{ key }}" class="{{ css_rank(r.rank) }}">No. {{ r.rank }} {{ r.title|raw }}</li>
-        {% if loop.last %}
+{%      if loop.last %}
         </ul>
     </div>
 </div>
-        {% endif %}
-    {% endfor %}
+{%      endif %}
+{%  endfor %}
 {% endif %}
 
 <div class="box">

templates/torrent/collage-add.twig

@@ -3,15 +3,15 @@
         <div class="pad">
             <form id="add-to-collage" action="collages.php" method="post">
 {% for collage in collage_list %}
-    {% if loop.first %}
+{%  if loop.first %}
             <select style="max-width: 100%" name="collage_combo" id="collage-select">
                 <option value="0">Choose recent...</option>
-    {% endif %}
+{%  endif %}
                 <option value="{{ collage.id }}">{{ collage.name }}</option>
-    {% if loop.last %}
+{%  if loop.last %}
             </select>
             <div>or search for collage name or URL:</div>
-    {% endif %}
+{%  endif %}
 {% else %}
             <div>Search for a collage name or URL:</div>
 {% endfor %}

templates/torrent/confirm-merge.twig

@@ -6,7 +6,7 @@
 <div class="box pad">
     <form class="confirm_form" name="torrent_group" action="torrents.php" method="post">
         <input type="hidden" name="action" value="merge" />
-        <input type="hidden" name="auth" value="{{ auth }}" />
+        <input type="hidden" name="auth" value="{{ viewer.auth }}" />
         <input type="hidden" name="confirm" value="true" />
         <input type="hidden" name="groupid" value="{{ old.id }}" />
         <input type="hidden" name="targetgroupid" value="{{ new.id }}" />

templates/torrent/confirm-move.twig

@@ -6,7 +6,7 @@
 <div class="box pad">
     <form class="confirm_form" name="torrent_group" action="torrents.php" method="post">
         <input type="hidden" name="action" value="editgroupid" />
-        <input type="hidden" name="auth" value="{{ auth }}" />
+        <input type="hidden" name="auth" value="{{ viewer.auth }}" />
         <input type="hidden" name="confirm" value="true" />
         <input type="hidden" name="torrentid" value="{{ torrent.id }}" />
         <input type="hidden" name="groupid" value="{{ new.id }}" />

templates/torrent/masspm.twig

@@ -6,7 +6,7 @@
     </div>
     <form class="send_form" name="mass_message" action="torrents.php" method="post">
         <input type="hidden" name="action" value="takemasspm" />
-        <input type="hidden" name="auth" value="{{ auth }}" />
+        <input type="hidden" name="auth" value="{{ viewer.auth }}" />
         <input type="hidden" name="torrentid" value="{{ torrent.id }}" />
         <table class="layout">
             <tr>

templates/user/history-freeleech.twig

@@ -1,4 +1,5 @@
 {{ header(user.username ~ ' › Freeleech token history') }}
+{% set own_profile = user.id == viewer.id %}
 <div class="header">
     <h2><a href="{{ user.location }}">{{ user.username }}</a> › Freeleech token history</h2>
 </div>
@@ -10,7 +11,7 @@
         <td>Torrent</td>
         <td>Time</td>
         <td>Expired</td>
-{% if own_profile or admin %}
+{% if own_profile or viewer.permitted('admin_fl_history') %}
         <td>Downloaded</td>
         <td>Size</td>
         <td>Tokens used</td>
@@ -21,15 +22,15 @@
         <td>{{ t.name|raw }}</td>
         <td class="nowrap">{{ t.created|time_diff }}</td>
         <td>{{ t.expired ? 'Yes' : 'No' }}
-    {%- if admin and not t.expired %}
-            &nbsp;<a href="userhistory.php?action=token_history&amp;expire=1&amp;auth={{ auth }}&amp;userid={{ user.id }}&amp;torrentid={{ t.torrent_id }}">(expire)</a>
-    {%- endif -%}
+{%  if viewer.permitted('admin_fl_history') and not t.expired -%}
+            &nbsp;<a href="userhistory.php?action=token_history&amp;expire=1&amp;auth={{ viewer.auth }}&amp;userid={{ user.id }}&amp;torrentid={{ t.torrent_id }}">(expire)</a>
+{%  endif -%}
         </td>
-    {% if own_profile or admin %}
+{%  if own_profile or viewer.permitted('admin_fl_history') %}
         <td class="nowrap">{{ t.downloaded|octet_size }}</td>
         <td class="nowrap">{{ t.size|octet_size }}</td>
         <td>{{ t.uses }}</td>
-     {% endif %}
+{%  endif %}
     </tr>
 {% endfor %}
 </table>