r5417 - trunk/cumin/python/cumin/grid
tmckay at fedoraproject.org
tmckay at fedoraproject.org
Mon Jun 18 21:15:29 UTC 2012
Author: tmckay
Date: 2012-06-18 21:15:27 +0000 (Mon, 18 Jun 2012)
New Revision: 5417
Modified:
trunk/cumin/python/cumin/grid/job.py
Log:
Role enforcement tweaks.
BZ769573 (mod)
Modified: trunk/cumin/python/cumin/grid/job.py
===================================================================
--- trunk/cumin/python/cumin/grid/job.py 2012-06-18 16:29:47 UTC (rev 5416)
+++ trunk/cumin/python/cumin/grid/job.py 2012-06-18 21:15:27 UTC (rev 5417)
@@ -16,7 +16,7 @@
from wooly import Widget, Parameter, Attribute
from wooly.util import StringCatalog, Writer, escape_amp, escape_entity,\
xml_escape
-from wooly.forms import Form, FormButton, StringField, NoXMLStringField
+from wooly.forms import Form, FormButton, StringField, NoXMLStringField, FormError
from wooly.widgets import ModeSet, PropertySet, TemplateRenderer, Notice
from wooly.template import WidgetTemplate
from wooly.parameters import ListParameter, IntegerParameter, DictParameter
@@ -439,6 +439,25 @@
reason = self.reason.render(session)
return "<table class=\"FormFieldSet\"><tbody>%s</tbody></table>%s" % (reason, content)
+ def validate(self, session):
+ super(JobObjectSelectorTaskForm, self).validate(session)
+ if not self.errors.get(session) and \
+ self.app.authorizator.is_enforcing():
+ # Check here to make sure the logged in user owns
+ # the job or is an admin
+ login = session.client_session.attributes["login_session"]
+ if "admin" not in login.group:
+ user = login.user.name
+ submission_id = self.submission_id.get(session)
+ cls = self.app.model.com_redhat_grid.Submission
+ submission = cls.get_object_by_id(session.cursor,
+ submission_id)
+ if hasattr(submission, "Owner") and submission.Owner != user:
+ f = FormError("The logged in user does not "\
+ "own this submission.")
+ self.errors.add(session, f)
+
+
class JobAdsSet(PropertySet):
types = {0: "expression",
1: "integer",
@@ -1141,6 +1160,22 @@
self.task.invoke(session, scheduler, job_id, reason, submission)
self.task.exit_with_redirect(session)
+ def validate(self, session):
+ super(JobActionForm, self).validate(session)
+ if not self.errors.get(session) and \
+ self.app.authorizator.is_enforcing():
+ # Check here to make sure the logged in user owns
+ # the job or is an admin
+ login = session.client_session.attributes["login_session"]
+ if "admin" not in login.group:
+ user = login.user.name
+ id = self.id.get(session)
+ submission = self.task.frame.get_submission(session, id)
+ if hasattr(submission, "Owner") and submission.Owner != user:
+ f = FormError("The logged in user does not "\
+ "own this submission.")
+ self.errors.add(session, f)
+
class ReasonField(NoXMLStringField):
def render_title(self, session):
return "Reason"
More information about the cumin-developers
mailing list