mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2025-07-05 02:09:13 +00:00
Code Issues 32 Releases Wiki Activity

[per-object-permissions] Fixed two bugs (noticed by Robert). 1) has_add_permission was not part of the new add user context and was causing an error when rendering the submit_row, changed view to have the has_add_permission 2) Custom SQL for checking if permissions exist was causing an error due to an incorrect False statment, corrected now.

Browse Source 
[per-object-permissions] Fixed a bug where delete row level permission was giving a PermissionDenied error falsely

git-svn-id: http://code.djangoproject.com/svn/django/branches/per-object-permissions@3655 bcc190cf-cafb-0310-a4f2-bffc1f526a37
This commit is contained in:
Christopher Long 2006-08-24 16:07:30 +00:00
parent 84771a606a
commit 7b2e3798f4
2 changed files with 18 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
django/contrib/admin/views/auth.py
View File

@ -27,6 +27,7 @@ def user_add_stage(request):
'is_popup': request.REQUEST.has_key('_popup'), 'is_popup': request.REQUEST.has_key('_popup'),
'add': True, 'add': True,
'change': False, 'change': False,
'has_add_permission': True,
'has_delete_permission': False, 'has_delete_permission': False,
'has_change_permission': True, 'has_change_permission': True,
'has_file_field': False, 'has_file_field': False,

31
django/contrib/auth/models.py
View File

@ -366,7 +366,7 @@ class User(models.Model):
#FROM "auth_user_groups" ug, "auth_rowlevelpermission" rlp, "django_content_type" ct #FROM "auth_user_groups" ug, "auth_rowlevelpermission" rlp, "django_content_type" ct
#WHERE rlp."owner_id" = ug."group_id" #WHERE rlp."owner_id" = ug."group_id"
#AND ug."user_id"=%s #AND ug."user_id"=%s
#AND rlp."negative" = 0 #AND rlp."negative" = False
#AND rlp."owner_ct_id" = %s #AND rlp."owner_ct_id" = %s
#AND rlp."model_ct_id" = %s #AND rlp."model_ct_id" = %s
@ -376,17 +376,16 @@ class User(models.Model):
FROM %s ug, %s rlp, %s ct FROM %s ug, %s rlp, %s ct
WHERE rlp.%s = ug.%s WHERE rlp.%s = ug.%s
AND ug.%s=%%s AND ug.%s=%%s
AND rlp.%s = 0 AND rlp.%s = %%s
AND rlp.%s = %%s AND rlp.%s = %%s
AND rlp.%s = %%s AND rlp.%s = %%s
AND rlp.%s = %%s""" % ( AND rlp.%s = %%s""" % (
backend.quote_name('auth_user_groups'), backend.quote_name('auth_rowlevelpermission'), backend.quote_name('auth_user_groups'), backend.quote_name('auth_rowlevelpermission'),
backend.quote_name('django_content_type'), backend.quote_name('owner_id'), backend.quote_name('django_content_type'), backend.quote_name('owner_id'),
backend.quote_name('group_id'), backend.quote_name('user_id'), backend.quote_name('group_id'), backend.quote_name('user_id'),
backend.quote_name('negative'), backend.quote_name('owner_ct_id'), backend.quote_name('negative'), backend.quote_name('owner_ct_id'),
backend.quote_name('model_ct_id'), backend.quote_name('permission_id')) backend.quote_name('model_ct_id'), backend.quote_name('permission_id'))
cursor.execute(sql, [self.id, False, ContentType.objects.get_for_model(Group).id, ct.id, perm.id])
cursor.execute(sql, [self.id, ContentType.objects.get_for_model(Group).id, ct.id, perm.id])
count = int(cursor.fetchone()[0]) count = int(cursor.fetchone()[0])
return (count>0) return (count>0)
@ -403,7 +402,7 @@ class User(models.Model):
#FROM "django_content_type" ct, "auth_rowlevelpermission" rlp #FROM "django_content_type" ct, "auth_rowlevelpermission" rlp
#WHERE rlp."model_ct_id" = ct."id" #WHERE rlp."model_ct_id" = ct."id"
#AND ct."app_label"=%s #AND ct."app_label"=%s
#AND rlp."negative" = 0 #AND rlp."negative" = False
#AND rlp."owner_ct_id" = %s #AND rlp."owner_ct_id" = %s
#AND rlp."owner_id" = %s #AND rlp."owner_id" = %s
cursor = connection.cursor() cursor = connection.cursor()
@ -412,17 +411,20 @@ class User(models.Model):
FROM %s ct, %s rlp FROM %s ct, %s rlp
WHERE rlp.%s = ct.%s WHERE rlp.%s = ct.%s
AND ct.%s=%%s AND ct.%s=%%s
AND rlp.%s = 0
AND rlp.%s = %%s AND rlp.%s = %%s
AND rlp.%s = %%s AND rlp.%s = %%s
""" % ( AND rlp.%s = %%s
""" % (
backend.quote_name('django_content_type'), backend.quote_name('auth_rowlevelpermission'), backend.quote_name('django_content_type'), backend.quote_name('auth_rowlevelpermission'),
backend.quote_name('model_ct_id'), backend.quote_name('id'), backend.quote_name('model_ct_id'), backend.quote_name('id'),
backend.quote_name('app_label'), backend.quote_name('negative'), backend.quote_name('app_label'),
backend.quote_name('owner_ct_id'), backend.quote_name('owner_ct_id'),
backend.quote_name('owner_id'), ) backend.quote_name('owner_id'),backend.quote_name('negative'), )
cursor.execute(sql, [app_label, ContentType.objects.get_for_model(User).id, self.id]) #import pdb
#pdb.set_trace()
cursor.execute(sql, [app_label, ContentType.objects.get_for_model(User).id, self.id, False])
count = int(cursor.fetchone()[0]) count = int(cursor.fetchone()[0])
print "User. App: %s, Count: %d" % (app_label, count)
if count>0: if count>0:
return True return True
return self.has_module_group_row_level_perms(app_label) return self.has_module_group_row_level_perms(app_label)
@ -434,7 +436,7 @@ class User(models.Model):
#AND ug."user_id"=%s #AND ug."user_id"=%s
#AND rlp."model_ct_id" = ct."id" #AND rlp."model_ct_id" = ct."id"
#AND ct."app_label"=%s #AND ct."app_label"=%s
#AND rlp."negative" = 0 #AND rlp."negative" = False
#AND rlp."owner_ct_id" = %s #AND rlp."owner_ct_id" = %s
cursor = connection.cursor() cursor = connection.cursor()
sql = """ sql = """
@ -444,7 +446,7 @@ class User(models.Model):
AND ug.%s=%%s AND ug.%s=%%s
AND rlp.%s = ct.%s AND rlp.%s = ct.%s
AND ct.%s=%%s AND ct.%s=%%s
AND rlp.%s = 0 AND rlp.%s = %%s
AND rlp.%s = %%s""" % ( AND rlp.%s = %%s""" % (
backend.quote_name('auth_user_groups'), backend.quote_name('auth_rowlevelpermission'), backend.quote_name('auth_user_groups'), backend.quote_name('auth_rowlevelpermission'),
backend.quote_name('django_content_type'), backend.quote_name('owner_id'), backend.quote_name('django_content_type'), backend.quote_name('owner_id'),
@ -452,8 +454,9 @@ class User(models.Model):
backend.quote_name('model_ct_id'), backend.quote_name('id'), backend.quote_name('model_ct_id'), backend.quote_name('id'),
backend.quote_name('app_label'), backend.quote_name('negative'), backend.quote_name('app_label'), backend.quote_name('negative'),
backend.quote_name('owner_ct_id')) backend.quote_name('owner_ct_id'))
cursor.execute(sql, [app_label, self.id, ContentType.objects.get_for_model(Group).id,]) cursor.execute(sql, [app_label, self.id, False, ContentType.objects.get_for_model(Group).id])
count = int(cursor.fetchone()[0]) count = int(cursor.fetchone()[0])
print "Group. App: %s, Count: %d" % (app_label, count)
return (count>0) return (count>0)