mirror of
https://gitlab.crans.org/bde/nk20
synced 2024-12-24 08:22:22 +00:00
a6b479db19
- /apps/activity/api/serializers.py - /apps/activity/api/urls.py - /apps/activity/api/views.py - /apps/activity/tests/test_activities.py - /apps/activity/__init__.py - /apps/activity/admin.py - /apps/activity/apps.py - /apps/activity/forms.py - /apps/activity/tables.py - /apps/activity/urls.py - /apps/activity/views.py - /apps/api/__init__.py - /apps/api/apps.py - /apps/api/serializers.py - /apps/api/tests.py - /apps/api/urls.py - /apps/api/views.py - /apps/api/viewsets.py - /apps/logs/signals.py - /apps/logs/apps.py - /apps/logs/__init__.py - /apps/logs/api/serializers.py - /apps/logs/api/urls.py - /apps/logs/api/views.py - /apps/member/api/serializers.py - /apps/member/api/urls.py - /apps/member/api/views.py - /apps/member/templatetags/memberinfo.py - /apps/member/__init__.py - /apps/member/admin.py - /apps/member/apps.py - /apps/member/auth.py - /apps/member/forms.py - /apps/member/hashers.py - /apps/member/signals.py - /apps/member/tables.py - /apps/member/urls.py - /apps/member/views.py - /apps/note/api/serializers.py - /apps/note/api/urls.py - /apps/note/api/views.py - /apps/note/models/__init__.py - /apps/note/static/note/js/consos.js - /apps/note/templates/note/mails/negative_balance.txt - /apps/note/templatetags/getenv.py - /apps/note/templatetags/pretty_money.py - /apps/note/tests/test_transactions.py - /apps/note/__init__.py - /apps/note/admin.py - /apps/note/apps.py - /apps/note/forms.py - /apps/note/signals.py - /apps/note/tables.py - /apps/note/urls.py - /apps/note/views.py - /apps/permission/api/serializers.py - /apps/permission/api/urls.py - /apps/permission/api/views.py - /apps/permission/templatetags/perms.py - /apps/permission/tests/test_oauth2.py - /apps/permission/tests/test_permission_denied.py - /apps/permission/tests/test_permission_queries.py - /apps/permission/tests/test_rights_page.py - /apps/permission/__init__.py - /apps/permission/admin.py - /apps/permission/backends.py - /apps/permission/apps.py - /apps/permission/decorators.py - /apps/permission/permissions.py - /apps/permission/scopes.py - /apps/permission/signals.py - /apps/permission/tables.py - /apps/permission/urls.py - /apps/permission/views.py - /apps/registration/tests/test_registration.py - /apps/registration/__init__.py - /apps/registration/apps.py - /apps/registration/forms.py - /apps/registration/tables.py - /apps/registration/tokens.py - /apps/registration/urls.py - /apps/registration/views.py - /apps/treasury/api/serializers.py - /apps/treasury/api/urls.py - /apps/treasury/api/views.py - /apps/treasury/templatetags/escape_tex.py - /apps/treasury/tests/test_treasury.py - /apps/treasury/__init__.py - /apps/treasury/admin.py - /apps/treasury/apps.py - /apps/treasury/forms.py - /apps/treasury/signals.py - /apps/treasury/tables.py - /apps/treasury/urls.py - /apps/treasury/views.py - /apps/wei/api/serializers.py - /apps/wei/api/urls.py - /apps/wei/api/views.py - /apps/wei/forms/surveys/__init__.py - /apps/wei/forms/surveys/base.py - /apps/wei/forms/surveys/wei2021.py - /apps/wei/forms/surveys/wei2022.py - /apps/wei/forms/surveys/wei2023.py - /apps/wei/forms/__init__.py - /apps/wei/forms/registration.py - /apps/wei/management/commands/export_wei_registrations.py - /apps/wei/management/commands/import_scores.py - /apps/wei/management/commands/wei_algorithm.py - /apps/wei/templates/wei/weilist_sample.tex - /apps/wei/tests/test_wei_algorithm_2021.py - /apps/wei/tests/test_wei_algorithm_2022.py - /apps/wei/tests/test_wei_algorithm_2023.py - /apps/wei/tests/test_wei_registration.py - /apps/wei/__init__.py - /apps/wei/admin.py - /apps/wei/apps.py - /apps/wei/tables.py - /apps/wei/urls.py - /apps/wei/views.py - /note_kfet/settings/__init__.py - /note_kfet/settings/base.py - /note_kfet/settings/development.py - /note_kfet/settings/secrets_example.py - /note_kfet/static/js/base.js - /note_kfet/admin.py - /note_kfet/inputs.py - /note_kfet/middlewares.py - /note_kfet/urls.py - /note_kfet/views.py - /note_kfet/wsgi.py - /entrypoint.sh
114 lines
4.2 KiB
Python
114 lines
4.2 KiB
Python
# Copyright (C) 2018-2024 by BDE ENS Paris-Saclay
|
|
# SPDX-License-Identifier: GPL-3.0-or-later
|
|
|
|
from django.core.exceptions import PermissionDenied
|
|
from django.utils.translation import gettext_lazy as _
|
|
from note_kfet.middlewares import get_current_request
|
|
from permission.backends import PermissionBackend
|
|
|
|
|
|
EXCLUDED = [
|
|
'cas_server.proxygrantingticket',
|
|
'cas_server.proxyticket',
|
|
'cas_server.serviceticket',
|
|
'cas_server.user',
|
|
'cas_server.userattributes',
|
|
'contenttypes.contenttype',
|
|
'logs.changelog',
|
|
'migrations.migration',
|
|
'oauth2_provider.accesstoken',
|
|
'oauth2_provider.grant',
|
|
'oauth2_provider.refreshtoken',
|
|
'sessions.session',
|
|
]
|
|
|
|
|
|
def pre_save_object(sender, instance, **kwargs):
|
|
"""
|
|
Before a model get saved, we check the permissions
|
|
"""
|
|
# noinspection PyProtectedMember
|
|
if instance._meta.label_lower in EXCLUDED:
|
|
return
|
|
|
|
if hasattr(instance, "_force_save") or hasattr(instance, "_no_signal"):
|
|
return
|
|
|
|
request = get_current_request()
|
|
if request is None:
|
|
# Action performed on shell is always granted
|
|
return
|
|
|
|
qs = sender.objects.filter(pk=instance.pk).all()
|
|
model_name_full = instance._meta.label_lower.split(".")
|
|
app_label = model_name_full[0]
|
|
model_name = model_name_full[1]
|
|
|
|
if qs.exists():
|
|
# We check if the user can change the model
|
|
|
|
# If the user has all right on a model, then OK
|
|
if PermissionBackend.check_perm(request, app_label + ".change_" + model_name, instance):
|
|
return
|
|
|
|
# In the other case, we check if he/she has the right to change one field
|
|
previous = qs.get()
|
|
|
|
for field in instance._meta.fields:
|
|
field_name = field.name
|
|
old_value = getattr(previous, field.name)
|
|
new_value = getattr(instance, field.name)
|
|
# If the field wasn't modified, no need to check the permissions
|
|
if old_value == new_value:
|
|
continue
|
|
|
|
if app_label == 'auth' and model_name == 'user' and field.name == 'password' and request.user.is_anonymous:
|
|
# We must ignore password changes from anonymous users since it can be done by people that forgot
|
|
# their password. We trust password change form.
|
|
continue
|
|
|
|
if not PermissionBackend.check_perm(request, app_label + ".change_" + model_name + "_" + field_name,
|
|
instance):
|
|
raise PermissionDenied(
|
|
_("You don't have the permission to change the field {field} on this instance of model"
|
|
" {app_label}.{model_name}.")
|
|
.format(field=field_name, app_label=app_label, model_name=model_name, )
|
|
)
|
|
else:
|
|
# We check if the user has right to add the object
|
|
has_perm = PermissionBackend.check_perm(request, app_label + ".add_" + model_name, instance)
|
|
|
|
if not has_perm:
|
|
raise PermissionDenied(
|
|
_("You don't have the permission to add an instance of model {app_label}.{model_name}.")
|
|
.format(app_label=app_label, model_name=model_name, ))
|
|
|
|
|
|
def pre_delete_object(instance, **kwargs):
|
|
"""
|
|
Before a model get deleted, we check the permissions
|
|
"""
|
|
# noinspection PyProtectedMember
|
|
if instance._meta.label_lower in EXCLUDED:
|
|
return
|
|
|
|
if hasattr(instance, "_force_delete") or hasattr(instance, "pk") and instance.pk == 0 \
|
|
or hasattr(instance, "_no_signal"):
|
|
# Don't check permissions on force-deleted objects
|
|
return
|
|
|
|
request = get_current_request()
|
|
if request is None:
|
|
# Action performed on shell is always granted
|
|
return
|
|
|
|
model_name_full = instance._meta.label_lower.split(".")
|
|
app_label = model_name_full[0]
|
|
model_name = model_name_full[1]
|
|
|
|
# We check if the user has rights to delete the object
|
|
if not PermissionBackend.check_perm(request, app_label + ".delete_" + model_name, instance):
|
|
raise PermissionDenied(
|
|
_("You don't have the permission to delete this instance of model {app_label}.{model_name}.")
|
|
.format(app_label=app_label, model_name=model_name))
|