r5416 - in trunk: cumin/python/cumin cumin/python/cumin/grid cumin/python/cumin/usergrid wooly/python/wooly
tmckay at fedoraproject.org
tmckay at fedoraproject.org
Mon Jun 18 16:29:48 UTC 2012
Author: tmckay
Date: 2012-06-18 16:29:47 +0000 (Mon, 18 Jun 2012)
New Revision: 5416
Modified:
trunk/cumin/python/cumin/grid/job.py
trunk/cumin/python/cumin/grid/submission.py
trunk/cumin/python/cumin/objectframe.py
trunk/cumin/python/cumin/usergrid/widgets.py
trunk/wooly/python/wooly/__init__.py
Log:
Role enforcement tweaks.
BZ769573 (mod)
Modified: trunk/cumin/python/cumin/grid/job.py
===================================================================
--- trunk/cumin/python/cumin/grid/job.py 2012-06-14 20:14:04 UTC (rev 5415)
+++ trunk/cumin/python/cumin/grid/job.py 2012-06-18 16:29:47 UTC (rev 5416)
@@ -97,6 +97,10 @@
return branch.marshal()
+ def not_viewable_redirect(self):
+ return (self.parent,
+ "Logged in user does not own the specified job")
+
class JobAdModes(ModeSet):
def __init__(self, app, name):
super(JobAdModes, self).__init__(app, name)
Modified: trunk/cumin/python/cumin/grid/submission.py
===================================================================
--- trunk/cumin/python/cumin/grid/submission.py 2012-06-14 20:14:04 UTC (rev 5415)
+++ trunk/cumin/python/cumin/grid/submission.py 2012-06-18 16:29:47 UTC (rev 5416)
@@ -24,17 +24,30 @@
log = logging.getLogger("cumin.grid.submission")
class SubmissionFrame(ObjectFrame):
- def __init__(self, app, name):
+ def __init__(self, app, name, check_viewable=False):
cls = app.model.com_redhat_grid.Submission
super(SubmissionFrame, self).__init__(app, name, cls)
+ # This will check whether or not the selected submission
+ # object is viewable by the logged in user during the
+ # processing pass.
+ self.do_check_viewable = check_viewable
+
self.job = JobFrame(app, "job", self.object)
self.add_mode(self.job)
+ # Ditto. This will check whether the selected job
+ # is viewable by the logged in user.
+ self.job.do_check_viewable = check_viewable
+
jobs = JobSelector(app, "jobs", self.object)
self.view.add_tab(jobs)
+ def not_viewable_redirect(self):
+ return (self.parent,
+ "Logged in user does not own the specified submission")
+
class PoolSubmissionFrame(SubmissionFrame):
# Use an ObjectView derivation here so that
# SubmissionFrame can use a different summary class later on...
Modified: trunk/cumin/python/cumin/objectframe.py
===================================================================
--- trunk/cumin/python/cumin/objectframe.py 2012-06-14 20:14:04 UTC (rev 5415)
+++ trunk/cumin/python/cumin/objectframe.py 2012-06-18 16:29:47 UTC (rev 5416)
@@ -35,6 +35,8 @@
self.tasks = list()
+ self.do_check_viewable = False
+
def init(self):
super(ObjectFrame, self).init()
@@ -56,19 +58,49 @@
return "%s '%s'" % (obj._class._title, obj.get_title())
+ def not_viewable_redirect(self):
+ return (self.parent,
+ "Logged in user does not own a specified object")
+
+ def check_viewable(self, obj, session):
+ login = session.client_session.attributes["login_session"]
+ user = login.user.name
+ okay = not hasattr(obj, "Owner") or obj.Owner == user
+ if okay:
+ frame = None
+ message = None
+ else:
+ frame, message = self.not_viewable_redirect()
+ return okay, frame, message
+
+ def set_redirect(self, session, frame, message):
+ nsession = session.branch()
+ frame.view.show(nsession)
+ url = nsession.marshal()
+ self.page.redirect.set(session, url)
+ session.add_notice(Notice(message))
+
def do_process(self, session):
# XXX don't process if this frame is invisible
id = self.id.get(session)
-
assert id
obj = self.get_object(session, id)
-
self.object.set(session, obj)
- super(ObjectFrame, self).do_process(session)
-
+ # If the check is turned on, see if the object can be
+ # viewed by the session. The check_viewable method will
+ # return a status, as well as a frame to redirect to and
+ # a message if the status is false
+ okay = not self.do_check_viewable or obj is None
+ if not okay:
+ okay, frame, message = self.check_viewable(obj, session)
+ if okay:
+ super(ObjectFrame, self).do_process(session)
+ else:
+ self.set_redirect(session, frame, message)
+
def _allow_none(self, session):
try:
return self.page.allow_object_not_found.get(session)
Modified: trunk/cumin/python/cumin/usergrid/widgets.py
===================================================================
--- trunk/cumin/python/cumin/usergrid/widgets.py 2012-06-14 20:14:04 UTC (rev 5415)
+++ trunk/cumin/python/cumin/usergrid/widgets.py 2012-06-18 16:29:47 UTC (rev 5416)
@@ -95,7 +95,8 @@
self.view = UserSubmissionSelector(app, "view", user)
self.add_mode(self.view)
- self.submission = SubmissionFrame(app, "submission")
+ self.submission = SubmissionFrame(app, "submission",
+ check_viewable=True)
self.add_mode(self.submission)
def render_title(self, session):
Modified: trunk/wooly/python/wooly/__init__.py
===================================================================
--- trunk/wooly/python/wooly/__init__.py 2012-06-14 20:14:04 UTC (rev 5415)
+++ trunk/wooly/python/wooly/__init__.py 2012-06-18 16:29:47 UTC (rev 5416)
@@ -510,11 +510,16 @@
self.process(session)
redirect = self.redirect.get(session)
+ if redirect:
+ raise PageRedirect()
+ rend = self.render(session)
+
+ redirect = self.redirect.get(session)
if redirect:
raise PageRedirect()
- return self.render(session)
+ return rend
def redirect_on_exception(self, session):
return None
More information about the cumin-developers
mailing list