From c8b13ff5e1a71ae699a000f553fdda56348ecacc Mon Sep 17 00:00:00 2001
From: JonnyWong16 <Jonny.Wong.16@gmail.com>
Date: Tue, 26 Apr 2016 20:18:49 -0700
Subject: [PATCH] Filter all graph data for guests

---
 data/interfaces/default/settings.html |  2 +-
 plexpy/datafactory.py                 | 16 ++---
 plexpy/graphs.py                      | 84 ++++++++++++++++++++++-----
 plexpy/webserve.py                    |  2 +
 plexpy/webstart.py                    |  8 +--
 5 files changed, 83 insertions(+), 29 deletions(-)

diff --git a/data/interfaces/default/settings.html b/data/interfaces/default/settings.html
index a5d1f29e..747034e1 100644
--- a/data/interfaces/default/settings.html
+++ b/data/interfaces/default/settings.html
@@ -418,7 +418,7 @@ available_notification_agents = sorted(notifiers.available_notification_agents()
                                     <input type="text" class="form-control http-settings" id="http_root" name="http_root" value="${config['http_root']}" data-parsley-trigger="change">
                                 </div>
                             </div>
-                            <p class="help-block">The base URL of the web server used for reverse proxies.</p>
+                            <p class="help-block">The base URL of the web server. Used for reverse proxies.</p>
                         </div>
                         <div class="checkbox">
                             <label>
diff --git a/plexpy/datafactory.py b/plexpy/datafactory.py
index 23c97b75..3e40d479 100644
--- a/plexpy/datafactory.py
+++ b/plexpy/datafactory.py
@@ -184,7 +184,7 @@ class DataFactory(object):
             library_cond = 'AND ('
             for section_id in session.get_session_libraries():
                 library_cond += 'session_history_metadata.section_id = %s OR ' % section_id
-            library_cond = library_cond.rstrip(' OR ') + ')'
+            library_cond = library_cond.rstrip(' OR ') + ') '
 
         home_stats = []
 
@@ -201,7 +201,7 @@ class DataFactory(object):
                             '   JOIN session_history_metadata ON session_history_metadata.id = session_history.id ' \
                             '   WHERE datetime(session_history.stopped, "unixepoch", "localtime") ' \
                             '       >= datetime("now", "-%s days", "localtime") ' \
-                            '       AND session_history.media_type = "episode" %s ' \
+                            '       AND session_history.media_type = "episode" %s' \
                             '   GROUP BY %s) AS t ' \
                             'GROUP BY t.grandparent_title ' \
                             'ORDER BY %s DESC ' \
@@ -246,7 +246,7 @@ class DataFactory(object):
                             '   JOIN session_history_metadata ON session_history_metadata.id = session_history.id ' \
                             '   WHERE datetime(session_history.stopped, "unixepoch", "localtime") ' \
                             '       >= datetime("now", "-%s days", "localtime") ' \
-                            '       AND session_history.media_type = "episode" %s ' \
+                            '       AND session_history.media_type = "episode" %s' \
                             '   GROUP BY %s) AS t ' \
                             'GROUP BY t.grandparent_title ' \
                             'ORDER BY users_watched DESC, %s DESC ' \
@@ -288,7 +288,7 @@ class DataFactory(object):
                             '   JOIN session_history_metadata ON session_history_metadata.id = session_history.id ' \
                             '   WHERE datetime(session_history.stopped, "unixepoch", "localtime") ' \
                             '       >= datetime("now", "-%s days", "localtime") ' \
-                            '       AND session_history.media_type = "movie" %s ' \
+                            '       AND session_history.media_type = "movie" %s' \
                             '   GROUP BY %s) AS t ' \
                             'GROUP BY t.full_title ' \
                             'ORDER BY %s DESC ' \
@@ -333,7 +333,7 @@ class DataFactory(object):
                             '   JOIN session_history_metadata ON session_history_metadata.id = session_history.id ' \
                             '   WHERE datetime(session_history.stopped, "unixepoch", "localtime") ' \
                             '       >= datetime("now", "-%s days", "localtime") ' \
-                            '       AND session_history.media_type = "movie" %s ' \
+                            '       AND session_history.media_type = "movie" %s' \
                             '   GROUP BY %s) AS t ' \
                             'GROUP BY t.full_title ' \
                             'ORDER BY users_watched DESC, %s DESC ' \
@@ -375,7 +375,7 @@ class DataFactory(object):
                             '   JOIN session_history_metadata ON session_history_metadata.id = session_history.id ' \
                             '   WHERE datetime(session_history.stopped, "unixepoch", "localtime") ' \
                             '       >= datetime("now", "-%s days", "localtime") ' \
-                            '       AND session_history.media_type = "track" %s ' \
+                            '       AND session_history.media_type = "track" %s' \
                             '   GROUP BY %s) AS t ' \
                             'GROUP BY t.grandparent_title ' \
                             'ORDER BY %s DESC ' \
@@ -420,7 +420,7 @@ class DataFactory(object):
                             '   JOIN session_history_metadata ON session_history_metadata.id = session_history.id ' \
                             '   WHERE datetime(session_history.stopped, "unixepoch", "localtime") ' \
                             '       >= datetime("now", "-%s days", "localtime") ' \
-                            '       AND session_history.media_type = "track" %s ' \
+                            '       AND session_history.media_type = "track" %s' \
                             '   GROUP BY %s) AS t ' \
                             'GROUP BY t.grandparent_title ' \
                             'ORDER BY users_watched DESC, %s DESC ' \
@@ -566,7 +566,7 @@ class DataFactory(object):
                             '   WHERE datetime(session_history.stopped, "unixepoch", "localtime") ' \
                             '       >= datetime("now", "-%s days", "localtime") ' \
                             '       AND (session_history.media_type = "movie" ' \
-                            '           OR session_history_metadata.media_type = "episode") %s ' \
+                            '           OR session_history_metadata.media_type = "episode") %s' \
                             '   GROUP BY %s) AS t ' \
                             'WHERE percent_complete >= %s ' \
                             'GROUP BY t.id ' \
diff --git a/plexpy/graphs.py b/plexpy/graphs.py
index e64bec51..1119ce4b 100644
--- a/plexpy/graphs.py
+++ b/plexpy/graphs.py
@@ -13,7 +13,7 @@
 #  You should have received a copy of the GNU General Public License
 #  along with PlexPy.  If not, see <http://www.gnu.org/licenses/>.
 
-from plexpy import logger, database, helpers, common
+from plexpy import logger, database, helpers, common, session
 import plexpy
 
 import datetime
@@ -30,7 +30,11 @@ class Graphs(object):
         if not time_range.isdigit():
             time_range = '30'
         
-        user_cond = ('AND user_id = %s ' % user_id) if user_id and user_id.isdigit() else ''
+        user_cond = ''
+        if session.get_session_user_id():
+            user_cond = 'AND session_history.user_id = %s ' % session.get_session_user_id()
+        elif user_id and user_id.isdigit():
+            user_cond = 'AND session_history.user_id = %s ' % user_id
         
         try:    
             if y_axis == 'plays':
@@ -110,7 +114,11 @@ class Graphs(object):
         if not time_range.isdigit():
             time_range = '30'
 
-        user_cond = ('AND user_id = %s ' % user_id) if user_id and user_id.isdigit() else ''
+        user_cond = ''
+        if session.get_session_user_id():
+            user_cond = 'AND session_history.user_id = %s ' % session.get_session_user_id()
+        elif user_id and user_id.isdigit():
+            user_cond = 'AND session_history.user_id = %s ' % user_id
         
         try:
             if y_axis == 'plays':
@@ -203,7 +211,11 @@ class Graphs(object):
         if not time_range.isdigit():
             time_range = '30'
 
-        user_cond = ('AND user_id = %s ' % user_id) if user_id and user_id.isdigit() else ''
+        user_cond = ''
+        if session.get_session_user_id():
+            user_cond = 'AND session_history.user_id = %s ' % session.get_session_user_id()
+        elif user_id and user_id.isdigit():
+            user_cond = 'AND session_history.user_id = %s ' % user_id
         
         try:
             if y_axis == 'plays':
@@ -281,7 +293,11 @@ class Graphs(object):
 
         monitor_db = database.MonitorDatabase()
 
-        user_cond = ('AND user_id = %s ' % user_id) if user_id and user_id.isdigit() else ''
+        user_cond = ''
+        if session.get_session_user_id():
+            user_cond = 'AND session_history.user_id = %s ' % session.get_session_user_id()
+        elif user_id and user_id.isdigit():
+            user_cond = 'AND session_history.user_id = %s ' % user_id
         
         try:
             if y_axis == 'plays':
@@ -365,7 +381,11 @@ class Graphs(object):
         if not time_range.isdigit():
             time_range = '30'
 
-        user_cond = ('AND user_id = %s ' % user_id) if user_id and user_id.isdigit() else ''
+        user_cond = ''
+        if session.get_session_user_id():
+            user_cond = 'AND session_history.user_id = %s ' % session.get_session_user_id()
+        elif user_id and user_id.isdigit():
+            user_cond = 'AND session_history.user_id = %s ' % user_id
         
         try:
             if y_axis == 'plays':
@@ -430,11 +450,16 @@ class Graphs(object):
         if not time_range.isdigit():
             time_range = '30'
 
-        user_cond = ('AND users.user_id = %s ' % user_id) if user_id and user_id.isdigit() else ''
+        user_cond = ''
+        if session.get_session_user_id():
+            user_cond = 'AND session_history.user_id = %s ' % session.get_session_user_id()
+        elif user_id and user_id.isdigit():
+            user_cond = 'AND session_history.user_id = %s ' % user_id
         
         try:
             if y_axis == 'plays':
                 query = 'SELECT ' \
+                        'users.user_id, users.username, ' \
                         '(CASE WHEN users.friendly_name IS NULL THEN users.username ELSE users.friendly_name END) AS friendly_name,' \
                         'SUM(CASE WHEN media_type = "episode" THEN 1 ELSE 0 END) AS tv_count, ' \
                         'SUM(CASE WHEN media_type = "movie" THEN 1 ELSE 0 END) AS movie_count, ' \
@@ -450,6 +475,7 @@ class Graphs(object):
                 result = monitor_db.select(query)
             else:
                 query = 'SELECT ' \
+                        'users.user_id, users.username, ' \
                         '(CASE WHEN users.friendly_name IS NULL THEN users.username ELSE users.friendly_name END) AS friendly_name,' \
                         'SUM(CASE WHEN media_type = "episode" AND stopped > 0 THEN (stopped - started) ' \
                         ' - (CASE WHEN paused_counter IS NULL THEN 0 ELSE paused_counter END) ELSE 0 END) AS tv_count, ' \
@@ -476,8 +502,10 @@ class Graphs(object):
         series_2 = []
         series_3 = []
 
+        session_user_id = session.get_session_user_id()
+
         for item in result:
-            categories.append(item['friendly_name'])
+            categories.append(item['username'] if str(item['user_id']) == session_user_id else item['friendly_name'])
             series_1.append(item['tv_count'])
             series_2.append(item['movie_count'])
             series_3.append(item['music_count'])
@@ -499,7 +527,11 @@ class Graphs(object):
         if not time_range.isdigit():
             time_range = '30'
 
-        user_cond = ('AND user_id = %s ' % user_id) if user_id and user_id.isdigit() else ''
+        user_cond = ''
+        if session.get_session_user_id():
+            user_cond = 'AND session_history.user_id = %s ' % session.get_session_user_id()
+        elif user_id and user_id.isdigit():
+            user_cond = 'AND session_history.user_id = %s ' % user_id
         
         try:
             if y_axis == 'plays':
@@ -593,7 +625,11 @@ class Graphs(object):
         if not time_range.isdigit():
             time_range = '30'
 
-        user_cond = ('AND user_id = %s ' % user_id) if user_id and user_id.isdigit() else ''
+        user_cond = ''
+        if session.get_session_user_id():
+            user_cond = 'AND session_history.user_id = %s ' % session.get_session_user_id()
+        elif user_id and user_id.isdigit():
+            user_cond = 'AND session_history.user_id = %s ' % user_id
         
         try:
             if y_axis == 'plays':
@@ -670,7 +706,11 @@ class Graphs(object):
         if not time_range.isdigit():
             time_range = '30'
 
-        user_cond = ('AND user_id = %s ' % user_id) if user_id and user_id.isdigit() else ''
+        user_cond = ''
+        if session.get_session_user_id():
+            user_cond = 'AND session_history.user_id = %s ' % session.get_session_user_id()
+        elif user_id and user_id.isdigit():
+            user_cond = 'AND session_history.user_id = %s ' % user_id
         
         try:
             if y_axis == 'plays':
@@ -767,7 +807,11 @@ class Graphs(object):
         if not time_range.isdigit():
             time_range = '30'
 
-        user_cond = ('AND user_id = %s ' % user_id) if user_id and user_id.isdigit() else ''
+        user_cond = ''
+        if session.get_session_user_id():
+            user_cond = 'AND session_history.user_id = %s ' % session.get_session_user_id()
+        elif user_id and user_id.isdigit():
+            user_cond = 'AND session_history.user_id = %s ' % user_id
         
         try:
             if y_axis == 'plays':
@@ -844,12 +888,17 @@ class Graphs(object):
         if not time_range.isdigit():
             time_range = '30'
 
-        user_cond = ('AND users.user_id = %s ' % user_id) if user_id and user_id.isdigit() else ''
+        user_cond = ''
+        if session.get_session_user_id():
+            user_cond = 'AND session_history.user_id = %s ' % session.get_session_user_id()
+        elif user_id and user_id.isdigit():
+            user_cond = 'AND session_history.user_id = %s ' % user_id
         
         try:
             if y_axis == 'plays':
                 query = 'SELECT ' \
-                        '(CASE WHEN users.friendly_name IS NULL THEN users.username ELSE users.friendly_name END) AS username, ' \
+                        'users.user_id, users.username, ' \
+                        '(CASE WHEN users.friendly_name IS NULL THEN users.username ELSE users.friendly_name END) AS friendly_name, ' \
                         'SUM(CASE WHEN session_history_media_info.transcode_decision = "direct play" ' \
                         'THEN 1 ELSE 0 END) AS dp_count, ' \
                         'SUM(CASE WHEN session_history_media_info.transcode_decision = "copy" ' \
@@ -869,7 +918,8 @@ class Graphs(object):
                 result = monitor_db.select(query)
             else:
                 query = 'SELECT ' \
-                        '(CASE WHEN users.friendly_name IS NULL THEN users.username ELSE users.friendly_name END) AS username, ' \
+                        'users.user_id, users.username, ' \
+                        '(CASE WHEN users.friendly_name IS NULL THEN users.username ELSE users.friendly_name END) AS friendly_name, ' \
                         'SUM(CASE WHEN session_history_media_info.transcode_decision = "direct play" ' \
                         'AND session_history.stopped > 0 THEN (session_history.stopped - session_history.started) ' \
                         ' - (CASE WHEN paused_counter IS NULL THEN 0 ELSE paused_counter END) ELSE 0 END) AS dp_count, ' \
@@ -901,8 +951,10 @@ class Graphs(object):
         series_2 = []
         series_3 = []
 
+        session_user_id = session.get_session_user_id()
+
         for item in result:
-            categories.append(item['username'])
+            categories.append(item['username'] if str(item['user_id']) == session_user_id else item['friendly_name'])
             series_1.append(item['dp_count'])
             series_2.append(item['ds_count'])
             series_3.append(item['tc_count'])
diff --git a/plexpy/webserve.py b/plexpy/webserve.py
index 3fa0d243..13b9df83 100644
--- a/plexpy/webserve.py
+++ b/plexpy/webserve.py
@@ -1109,6 +1109,8 @@ class WebInterface(object):
     @cherrypy.expose
     @requireAuth()
     def history_table_modal(self, **kwargs):
+        if kwargs.get('user_id') and not allow_session_user(kwargs['user_id']):
+            return serve_template(templatename="history_table_modal.html", title="History Data", data=None)
 
         return serve_template(templatename="history_table_modal.html", title="History Data", data=kwargs)
 
diff --git a/plexpy/webstart.py b/plexpy/webstart.py
index f1ca1b9e..1c416eeb 100644
--- a/plexpy/webstart.py
+++ b/plexpy/webstart.py
@@ -53,6 +53,10 @@ def initialize(options):
         'tools.decode.on': True
     }
 
+    if plexpy.DEV:
+        options_dict['environment'] = "test_suite"
+        options_dict['engine.autoreload.on'] = True
+
     if enable_https:
         options_dict['server.ssl_certificate'] = https_cert
         options_dict['server.ssl_private_key'] = https_key
@@ -60,10 +64,6 @@ def initialize(options):
     else:
         protocol = "http"
 
-    if plexpy.DEV:
-        options_dict['environment'] = "test_suite"
-        options_dict['engine.autoreload.on'] = True
-
     if options['http_password']:
         logger.info("Web server authentication is enabled, username is '%s'", options['http_username'])
         options_dict['tools.auth.on'] = True