Add HTML form entry point

app/controllers/api.py

@@ -89,69 +89,3 @@ def new_comment():
         abort(400)
 
     return "OK"
-
-
-@app.route("/report", methods=['GET'])
-def report():
-
-    try:
-        token = request.args.get('token', '')
-        secret = request.args.get('secret', '')
-
-        if secret != config.SECRET:
-            logger.warn('Unauthorized request')
-            abort(401)
-
-        site = Site.select().where(Site.token == token).get()
-        if site is None:
-            logger.warn('Unknown site %s' % token)
-            abort(404)
-
-        processor.enqueue({'request': 'report', 'data': token})
-
-
-    except:
-        logger.exception("report failure")
-        abort(500)
-
-    return "OK"
-
-
-@app.route("/accept", methods=['GET'])
-def accept_comment():
-
-    try:
-        id = request.args.get('comment', '')
-        secret = request.args.get('secret', '')
-
-        if secret != config.SECRET:
-            logger.warn('Unauthorized request')
-            abort(401)
-
-        processor.enqueue({'request': 'late_accept', 'data': id})
-
-    except:
-        logger.exception("accept failure")
-        abort(500)
-
-    return "PUBLISHED"
-
-
-@app.route("/reject", methods=['GET'])
-def reject_comment():
-
-    try:
-        id = request.args.get('comment', '')
-        secret = request.args.get('secret', '')
-
-        if secret != config.SECRET:
-            logger.warn('Unauthorized request')
-            abort(401)
-
-        processor.enqueue({'request': 'late_reject', 'data': id})
-
-    except:
-        logger.exception("reject failure")
-        abort(500)
-
-    return "REJECTED"

app/controllers/form.py

@@ -0,0 +1,41 @@
+#!/usr/bin/env python
+# -*- coding: utf-8 -*-
+
+import logging
+import config
+from flask import request, jsonify, abort
+from app import app
+from app.models.site import Site
+from app.models.comment import Comment
+from app.helpers.hashing import md5
+from app.services import processor
+
+logger = logging.getLogger(__name__)
+
+@app.route("/newcomment", methods=['POST'])
+def new_form_comment():
+
+    try:
+        data = request.form
+        logger.info(data)
+
+        # validate token: retrieve site entity
+        token = data.get('token', '')
+        site = Site.select().where(Site.token == token).get()
+        if site is None:
+            logger.warn('Unknown site %s' % token)
+            abort(400)
+
+        # honeypot for spammers
+        captcha = data.get('captcha', '')
+        if captcha:
+            logger.warn('discard spam: data %s' % data)
+            abort(400)
+
+        processor.enqueue({'request': 'new_comment', 'data': data})
+
+    except:
+        logger.exception("new comment failure")
+        abort(400)
+
+    return "OK"

app/controllers/report.py

@@ -0,0 +1,78 @@
+#!/usr/bin/env python
+# -*- coding: utf-8 -*-
+
+import logging
+import config
+from flask import request, jsonify, abort
+from app import app
+from app.models.site import Site
+from app.models.comment import Comment
+from app.helpers.hashing import md5
+from app.services import processor
+
+logger = logging.getLogger(__name__)
+
+@app.route("/report", methods=['GET'])
+def report():
+
+    try:
+        token = request.args.get('token', '')
+        secret = request.args.get('secret', '')
+
+        if secret != config.SECRET:
+            logger.warn('Unauthorized request')
+            abort(401)
+
+        site = Site.select().where(Site.token == token).get()
+        if site is None:
+            logger.warn('Unknown site %s' % token)
+            abort(404)
+
+        processor.enqueue({'request': 'report', 'data': token})
+
+
+    except:
+        logger.exception("report failure")
+        abort(500)
+
+    return "OK"
+
+
+@app.route("/accept", methods=['GET'])
+def accept_comment():
+
+    try:
+        id = request.args.get('comment', '')
+        secret = request.args.get('secret', '')
+
+        if secret != config.SECRET:
+            logger.warn('Unauthorized request')
+            abort(401)
+
+        processor.enqueue({'request': 'late_accept', 'data': id})
+
+    except:
+        logger.exception("accept failure")
+        abort(500)
+
+    return "PUBLISHED"
+
+
+@app.route("/reject", methods=['GET'])
+def reject_comment():
+
+    try:
+        id = request.args.get('comment', '')
+        secret = request.args.get('secret', '')
+
+        if secret != config.SECRET:
+            logger.warn('Unauthorized request')
+            abort(401)
+
+        processor.enqueue({'request': 'late_reject', 'data': id})
+
+    except:
+        logger.exception("reject failure")
+        abort(500)
+
+    return "REJECTED"