From 3d401ce8568a1fc4d9a99a1d5d9a359e2f05ef57 Mon Sep 17 00:00:00 2001 From: Alexey Bezhan Date: Thu, 7 Mar 2019 11:05:44 +0000 Subject: [PATCH] Hide current folder templates if user doesn't have a folder permission TemplateList gets a list of templates in a current folder separately, so we need to make sure `service.get_templates` checks for the appropriate user permission --- app/models/service.py | 7 ++++++- app/models/template_list.py | 2 +- 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/app/models/service.py b/app/models/service.py index 161d77116..3595c1dcb 100644 --- a/app/models/service.py +++ b/app/models/service.py @@ -154,7 +154,12 @@ class Service(): def all_template_ids(self): return {template['id'] for template in self.all_templates} - def get_templates(self, template_type='all', template_folder_id=None): + def get_templates(self, template_type='all', template_folder_id=None, user_id=None): + if user_id and template_folder_id and self.has_permission('edit_folder_permissions'): + folder = self.get_template_folder(template_folder_id) + if user_id not in folder.get("users_with_permission", []): + return [] + if isinstance(template_type, str): template_type = [template_type] if template_folder_id: diff --git a/app/models/template_list.py b/app/models/template_list.py index e8bf0a9e2..ad479b115 100644 --- a/app/models/template_list.py +++ b/app/models/template_list.py @@ -40,7 +40,7 @@ class TemplateList(): yield sub_item for item in self.service.get_templates( - template_type, template_folder_id + template_type, template_folder_id, user_id ): yield TemplateListTemplate( item,