r5417 - trunk/cumin/python/cumin/grid

tmckay at fedoraproject.org tmckay at fedoraproject.org
Mon Jun 18 21:15:29 UTC 2012


Author: tmckay
Date: 2012-06-18 21:15:27 +0000 (Mon, 18 Jun 2012)
New Revision: 5417

Modified:
   trunk/cumin/python/cumin/grid/job.py
Log:
Role enforcement tweaks.
BZ769573 (mod)


Modified: trunk/cumin/python/cumin/grid/job.py
===================================================================
--- trunk/cumin/python/cumin/grid/job.py	2012-06-18 16:29:47 UTC (rev 5416)
+++ trunk/cumin/python/cumin/grid/job.py	2012-06-18 21:15:27 UTC (rev 5417)
@@ -16,7 +16,7 @@
 from wooly import Widget, Parameter, Attribute
 from wooly.util import StringCatalog, Writer, escape_amp, escape_entity,\
     xml_escape
-from wooly.forms import Form, FormButton, StringField, NoXMLStringField
+from wooly.forms import Form, FormButton, StringField, NoXMLStringField, FormError
 from wooly.widgets import ModeSet, PropertySet, TemplateRenderer, Notice
 from wooly.template import WidgetTemplate
 from wooly.parameters import ListParameter, IntegerParameter, DictParameter
@@ -439,6 +439,25 @@
         reason = self.reason.render(session)
         return "<table class=\"FormFieldSet\"><tbody>%s</tbody></table>%s" % (reason, content)
 
+    def validate(self, session):
+        super(JobObjectSelectorTaskForm, self).validate(session)
+        if not self.errors.get(session) and \
+               self.app.authorizator.is_enforcing():
+            # Check here to make sure the logged in user owns
+            # the job or is an admin
+            login = session.client_session.attributes["login_session"]
+            if "admin" not in login.group:
+                user = login.user.name
+                submission_id = self.submission_id.get(session)
+                cls = self.app.model.com_redhat_grid.Submission
+                submission = cls.get_object_by_id(session.cursor, 
+                                                  submission_id)
+                if hasattr(submission, "Owner") and submission.Owner != user:
+                    f = FormError("The logged in user does not "\
+                                  "own this submission.")
+                    self.errors.add(session, f)
+
+
 class JobAdsSet(PropertySet):
     types = {0: "expression",
              1: "integer",
@@ -1141,6 +1160,22 @@
             self.task.invoke(session, scheduler, job_id, reason, submission)
             self.task.exit_with_redirect(session)
 
+    def validate(self, session):
+        super(JobActionForm, self).validate(session)
+        if not self.errors.get(session) and \
+               self.app.authorizator.is_enforcing():
+            # Check here to make sure the logged in user owns
+            # the job or is an admin
+            login = session.client_session.attributes["login_session"]
+            if "admin" not in login.group:
+                user = login.user.name
+                id = self.id.get(session)
+                submission = self.task.frame.get_submission(session, id)
+                if hasattr(submission, "Owner") and submission.Owner != user:
+                    f = FormError("The logged in user does not "\
+                                  "own this submission.")
+                    self.errors.add(session, f)
+
 class ReasonField(NoXMLStringField):
     def render_title(self, session):
         return "Reason"



More information about the cumin-developers mailing list