Author: tmckay
Date: 2013-12-20 16:45:58 +0000 (Fri, 20 Dec 2013)
New Revision: 5792
Modified:
branches/statusquo/cumin/python/cumin/parameters.py
branches/statusquo/cumin/python/cumin/widgets.py
branches/statusquo/wooly/python/wooly/server.py
Log:
Additional fix for BZ1015692
Modified: branches/statusquo/cumin/python/cumin/parameters.py
===================================================================
--- branches/statusquo/cumin/python/cumin/parameters.py 2013-12-20 16:43:39 UTC (rev
5791)
+++ branches/statusquo/cumin/python/cumin/parameters.py 2013-12-20 16:45:58 UTC (rev
5792)
@@ -10,6 +10,11 @@
return login.user
+ def set(self, session, value):
+ # Since we always redirect the user attribute to the
+ # login session on get, make it explicit that we do nothing here
+ return None
+
class CuminClassParameter(Parameter):
def do_unmarshal(self, string):
return getattr(self.app.model, string, None)
Modified: branches/statusquo/cumin/python/cumin/widgets.py
===================================================================
--- branches/statusquo/cumin/python/cumin/widgets.py 2013-12-20 16:43:39 UTC (rev 5791)
+++ branches/statusquo/cumin/python/cumin/widgets.py 2013-12-20 16:45:58 UTC (rev 5792)
@@ -1527,8 +1527,21 @@
for cls, package, agent in zip(classes, packages, agents):
rosemary_package = self.app.model._packages_by_name[package]
rosemary_cls = rosemary_package._classes_by_name[cls]
- objects.append(rosemary_cls.get_object(cursor, _qmf_object_id=agent))
+ obj = rosemary_cls.get_object(cursor, _qmf_object_id=agent)
+ if obj is None:
+ continue
+ # A more general solution may be needed here in the future to
+ # restrict objects during csv export. Currently, submissions are the only
objects
+ # visible to the user role and they have an Owner field.
+ # Make sure the Owner matches the logged in user for each record.
+ # An admin role needs no restrictions.
+ if not self.app.authorizator.is_enforcing() or \
+ not cls in ["Submission"] or \
+ session.client_session.check_owner(obj.Owner, treat_admin_as_owner=True):
+ objects.append(obj)
+ else:
+ raise Exception("Error exporting CSV, current user does not own
that!")
return objects
def get_file_name(self, session):
Modified: branches/statusquo/wooly/python/wooly/server.py
===================================================================
--- branches/statusquo/wooly/python/wooly/server.py 2013-12-20 16:43:39 UTC (rev 5791)
+++ branches/statusquo/wooly/python/wooly/server.py 2013-12-20 16:45:58 UTC (rev 5792)
@@ -377,9 +377,11 @@
self.attributes = dict()
- def check_owner(self, owner):
- user = self.attributes["login_session"].user.name
- return owner == user
+ def check_owner(self, owner, treat_admin_as_owner=False):
+ login = self.attributes["login_session"]
+ if owner != login.user.name:
+ return treat_admin_as_owner and "admin" in login.group
+ return True
def get_csrf(self):
return self.csrf
Show replies by date