mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2025-07-05 02:09:13 +00:00
Code Issues 32 Releases Wiki Activity

[per-object-permissions] Fixed some problems with checking of permissions

Browse Source 
git-svn-id: http://code.djangoproject.com/svn/django/branches/per-object-permissions@3487 bcc190cf-cafb-0310-a4f2-bffc1f526a37
This commit is contained in:
Christopher Long 2006-07-29 18:27:50 +00:00
parent 340718bd3a
commit 68072fa75c
3 changed files with 20 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
django/contrib/admin/templates/admin/change_form.html
View File

@ -66,7 +66,7 @@
</div> </div>
</form> </form>
{% if rlp_form_list %} {% if new_rlp_form %}
{% include "admin/row_level_permission.html" %} {% include "admin/row_level_permission.html" %}
{% endif %} {% endif %}

1
django/contrib/admin/views/main.py
View File

@ -391,7 +391,6 @@ def change_stage(request, app_label, model_name, object_id):
'object_id': object_id, 'object_id': object_id,
'original': manipulator.original_object, 'original': manipulator.original_object,
'is_popup': request.REQUEST.has_key('_popup'), 'is_popup': request.REQUEST.has_key('_popup'),
'is_row_level_perm': model._meta.row_level_permissions,
}) })
if model._meta.row_level_permissions: if model._meta.row_level_permissions:

29
django/contrib/admin/views/row_level_permissions.py
View File

@ -4,6 +4,7 @@ from django.http import Http404, HttpResponse, HttpResponseRedirect
from django.contrib.contenttypes.models import ContentType from django.contrib.contenttypes.models import ContentType
from django.contrib.auth.models import RowLevelPermission from django.contrib.auth.models import RowLevelPermission
from django.contrib.admin.row_level_perm_manipulator import AddRLPManipulator, ChangeRLPManipulator from django.contrib.admin.row_level_perm_manipulator import AddRLPManipulator, ChangeRLPManipulator
from django.core.exceptions import ImproperlyConfigured, ObjectDoesNotExist, PermissionDenied
import simplejson import simplejson
def delete_row_level_permission(request, ct_id, rlp_id, hash, ajax=None): def delete_row_level_permission(request, ct_id, rlp_id, hash, ajax=None):
@ -15,7 +16,7 @@ def delete_row_level_permission(request, ct_id, rlp_id, hash, ajax=None):
opts = rlp._meta opts = rlp._meta
if not request.user.has_perm(opts.app_label + '.' + opts.get_delete_permission()): if not request.user.has_perm(opts.app_label + '.' + opts.get_delete_permission()):
raise PermissionDenied raise PermissionDenied
if not request.user.has_perm(obj._meta.app_label + '.' + obj._meta.get_delete_permission()): if not request.user.has_perm(obj._meta.app_label + '.' + obj._meta.get_change_permission()()):
raise PermissionDenied raise PermissionDenied
rlp.delete() rlp.delete()
msg = {"result":True, "text":_("Row level permission was successful deleted"), "id":rlp_id} msg = {"result":True, "text":_("Row level permission was successful deleted"), "id":rlp_id}
@ -38,9 +39,12 @@ def add_row_level_permission(request, ct_id, obj_id, ajax=None):
ct = get_object_or_404(ContentType, pk=ct_id) ct = get_object_or_404(ContentType, pk=ct_id)
obj = get_object_or_404(ct.model_class(), pk=obj_id) obj = get_object_or_404(ct.model_class(), pk=obj_id)
if not request.user.has_perm(obj._meta.app_label + '.' + obj._meta.get_add_permission()): if not request.user.has_perm(obj._meta.app_label + '.' + obj._meta.get_change_permission()):
raise PermissionDenied raise PermissionDenied
if not request.user.has_perm(RowLevelPermission._meta.app_label + '.' + RowLevelPermission._meta.get_add_permission()):
raise PermissionDenied
manip = AddRLPManipulator(obj, ct) manip = AddRLPManipulator(obj, ct)
@ -54,7 +58,10 @@ def add_row_level_permission(request, ct_id, obj_id, ajax=None):
except validators.ValidationError: except validators.ValidationError:
msg = {"result":False, "text":_("A row level permission already exists with the specified values.")} msg = {"result":False, "text":_("A row level permission already exists with the specified values.")}
else: else:
msg = {"result":True, "text":_("Row level permission has successful been added.")} if len(rlp_list) is 1:
msg = {"result":True, "text":_("Row level permission has successfully been added.")}
else:
msg = {"result":True, "text":_("Row level permissions have successfully been added.")}
if not ajax: if not ajax:
request.user.message_set.create(message=msg['text']) request.user.message_set.create(message=msg['text'])
return HttpResponseRedirect("../../../../../%s/%s/%s" % (obj._meta.app_label, obj._meta.module_name , str(obj.id))) return HttpResponseRedirect("../../../../../%s/%s/%s" % (obj._meta.app_label, obj._meta.module_name , str(obj.id)))
@ -80,12 +87,14 @@ def change_row_level_permission(request, ct_id, rlp_id, hash, ajax=None):
request.user.message_set.create(message=msg['text']) request.user.message_set.create(message=msg['text'])
return HttpResponseRedirect("/edit/%s/%s" % (obj_type, obj_id)) return HttpResponseRedirect("/edit/%s/%s" % (obj_type, obj_id))
obj = get_object_or_404(RowLevelPermission, pk=rlp_id) rlp = get_object_or_404(RowLevelPermission, pk=rlp_id)
opts = obj._meta opts = rlp._meta
if not request.user.has_perm(opts.app_label + '.' + opts.get_add_permission()):
raise PermissionDenied
#if not request.user.has_perm(app_label + '.' + opts.get_change_permission()): object_model = rlp.type_ct.model_class()
#if not request.user.has_perm(opts.get_change_permission()): if not request.user.has_perm(object_model._meta.app_label + '.' + object_model._meta.get_change_permission()):
#raise PermissionDenied raise PermissionDenied
manip = ChangeRLPManipulator() manip = ChangeRLPManipulator()
new_data = request.POST.copy() new_data = request.POST.copy()
@ -102,4 +111,4 @@ def change_row_level_permission(request, ct_id, rlp_id, hash, ajax=None):
if ajax: if ajax:
return HttpResponse(simplejson.dumps(msg), 'text/javascript') return HttpResponse(simplejson.dumps(msg), 'text/javascript')
request.user.message_set.create(message=msg['text']) request.user.message_set.create(message=msg['text'])
return HttpResponseRedirect("../../../../../../%s/%s/%s" % (new_rlp.type._meta.app_label, new_rlp.type._meta.module_name , str(rlp.type_id))) return HttpResponseRedirect("../../../../../../%s/%s/%s" % (object_model._meta.app_label, object_model._meta.module_name , str(rlp.type_id)))