Function discussion_file_stream

Scripts/ButSystem.py:13020–13060

Inline media stream for Discussion attachments.

(fid: int)

        return redirect(url_for("admin_panel"))
    # Do not promote self redundantly
    conn = db_connect()
    row = conn.execute("SELECT is_admin FROM users WHERE username=?", (u,)).fetchone()
    if not row:
        conn.close()
        flash("User not found.")
        return redirect(url_for("admin_panel"))
    if int(row["is_admin"]) == 1:
        conn.close()
        flash("User is already an admin.")
        return redirect(url_for("admin_panel"))

    # Promote + bind to this device (admin actions are allowed only locally on the host device)
    conn.execute("UPDATE users SET is_admin=1, admin_device_id=? WHERE username=?", (DEVICE_ID, u))
    conn.commit()
    conn.close()
    flash(f"Promoted @{u} to admin.")
    return redirect(url_for("admin_panel"))

@app.route("/admin/demote", methods=["POST"])
@login_required
def admin_demote():
    """admin_demote.

Admin-only route handler.

This docstring was expanded to make future maintenance easier.

Returns:
    Varies.
"""
    require_admin()
    try:
        log_security_event("admin_action", detail="demote_user", username=current_user(), level="info")
    except Exception:
        pass
    u = (request.form.get("username") or "").strip()
    if not u:
        return redirect(url_for("admin_panel"))
    if u == current_user():
        flash("You cannot demote yourself here.")
        return redirect(url_for("admin_panel"))

    conn = db_connect()
    # Ensure we don't remove the last admin