darkhelm/notifications-admin
1
0
Fork 0
mirror of https://github.com/GSA/notifications-admin.git synced 2026-09-07 15:08:25 -04:00
Code Issues Packages Projects Releases Wiki Activity

Add user permission check to template folder actions

Browse Source
This commit is contained in:
Alexey Bezhan
2019-03-20 17:26:51 +00:00
parent 792b625de7
commit bfe6768796
4 changed files with 22 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
app/main/views/templates.py
View File

@@ -160,6 +160,7 @@ def choose_template(service_id, template_type='all', template_folder_id=None):
def process_folder_management_form(form, current_folder_id):
current_service.get_template_folder_with_user_permission_or_403(current_folder_id, current_user)
new_folder_id = None
if form.is_add_template_op:
@@ -438,10 +439,10 @@ def action_blocked(service_id, notification_type, return_to, template_id):
@login_required
@user_has_permissions('manage_templates')
def manage_template_folder(service_id, template_folder_id):
current_folder = current_service.get_template_folder(template_folder_id)
template_folder = current_service.get_template_folder_with_user_permission_or_403(template_folder_id, current_user)
form = TemplateFolderForm(
name=current_folder['name'],
users_with_permission=current_folder.get('users_with_permission', None),
name=template_folder['name'],
users_with_permission=template_folder.get('users_with_permission', None),
all_service_users=[user for user in current_service.active_users if user.id != current_user.id]
)
if form.validate_on_submit():
@@ -470,7 +471,7 @@ def manage_template_folder(service_id, template_folder_id):
@login_required
@user_has_permissions('manage_templates')
def delete_template_folder(service_id, template_folder_id):
template_folder = current_service.get_template_folder(template_folder_id)
template_folder = current_service.get_template_folder_with_user_permission_or_403(template_folder_id, current_user)
if len(current_service.get_template_folders_and_templates(
template_type="all", template_folder_id=template_folder_id

15
app/models/service.py
View File

@@ -174,17 +174,22 @@ class Service():
def get_template(self, template_id, version=None):
return service_api_client.get_service_template(self.id, str(template_id), version)['data']
def get_template_with_user_permission_or_403(self, template_id, user):
template = self.get_template(template_id)
def get_template_folder_with_user_permission_or_403(self, folder_id, user):
template_folder = self.get_template_folder(folder_id)
if not self.has_permission("edit_folder_permissions"):
return template
template_folder = self.get_template_folder(template["folder"])
return template_folder
if not user.has_template_folder_permission(template_folder):
abort(403)
return template_folder
def get_template_with_user_permission_or_403(self, template_id, user):
template = self.get_template(template_id)
self.get_template_folder_with_user_permission_or_403(template['folder'], user)
return template
@property