Changeset - 32f66c839c54
[Not reviewed]
beta
0 3 0
Marcin Kuzminski - 13 years ago 2013-04-23 02:55:50
marcin@python-works.com
managing users groups enforce permissions checks.
User needs at least a read permissions on usergroup to be able
to assign it somewhere.
3 files changed with 39 insertions and 16 deletions:
0 comments (0 inline, 0 general)
rhodecode/model/repo.py
Show inline comments
 
@@ -32,26 +32,27 @@ from datetime import datetime
 
from rhodecode.lib.vcs.backends import get_backend
 
from rhodecode.lib.compat import json
 
from rhodecode.lib.utils2 import LazyProperty, safe_str, safe_unicode,\
 
    remove_prefix, obfuscate_url_pw
 
from rhodecode.lib.caching_query import FromCache
 
from rhodecode.lib.hooks import log_create_repository, log_delete_repository
 

	
 
from rhodecode.model import BaseModel
 
from rhodecode.model.db import Repository, UserRepoToPerm, User, Permission, \
 
    Statistics, UserGroup, UserGroupRepoToPerm, RhodeCodeUi, RepoGroup,\
 
    RhodeCodeSetting, RepositoryField
 
from rhodecode.lib import helpers as h
 
from rhodecode.lib.auth import HasRepoPermissionAny
 
from rhodecode.lib.auth import HasRepoPermissionAny, HasUserGroupPermissionAny
 
from rhodecode.lib.exceptions import AttachedForksError
 
from rhodecode.model.scm import UserGroupList
 

	
 
log = logging.getLogger(__name__)
 

	
 

	
 
class RepoModel(BaseModel):
 

	
 
    cls = Repository
 
    URL_SEPARATOR = Repository.url_sep()
 

	
 
    def _get_user_group(self, users_group):
 
        return self._get_instance(UserGroup, users_group,
 
                                  callback=UserGroup.get_by_group_name)
 
@@ -131,25 +132,27 @@ class RepoModel(BaseModel):
 
            {
 
             'id': u.user_id,
 
             'fname': u.name,
 
             'lname': u.lastname,
 
             'nname': u.username,
 
             'gravatar_lnk': h.gravatar_url(u.email, 14)
 
            } for u in users]
 
        )
 

	
 
    def get_users_groups_js(self):
 
        users_groups = self.sa.query(UserGroup)\
 
            .filter(UserGroup.users_group_active == True).all()
 

	
 
        users_groups = UserGroupList(users_groups, perm_set=['usergroup.read',
 
                                                             'usergroup.write',
 
                                                             'usergroup.admin'])
 
        return json.dumps([
 
            {
 
             'id': gr.users_group_id,
 
             'grname': gr.users_group_name,
 
             'grmembers': len(gr.members),
 
            } for gr in users_groups]
 
        )
 

	
 
    @classmethod
 
    def _render_datatable(cls, tmpl, *args, **kwargs):
 
        import rhodecode
 
        from pylons import tmpl_context as c
 
@@ -463,37 +466,43 @@ class RepoModel(BaseModel):
 
            perms_new = []
 
        if not perms_updates:
 
            perms_updates = []
 

	
 
        # update permissions
 
        for member, perm, member_type in perms_updates:
 
            if member_type == 'user':
 
                # this updates existing one
 
                self.grant_user_permission(
 
                    repo=repo, user=member, perm=perm
 
                )
 
            else:
 
                self.grant_users_group_permission(
 
                    repo=repo, group_name=member, perm=perm
 
                )
 
                #check if we have permissions to alter this usergroup
 
                if HasUserGroupPermissionAny('usergroup.read', 'usergroup.write',
 
                                             'usergroup.admin')(member):
 
                    self.grant_users_group_permission(
 
                        repo=repo, group_name=member, perm=perm
 
                    )
 
        # set new permissions
 
        for member, perm, member_type in perms_new:
 
            if member_type == 'user':
 
                self.grant_user_permission(
 
                    repo=repo, user=member, perm=perm
 
                )
 
            else:
 
                self.grant_users_group_permission(
 
                    repo=repo, group_name=member, perm=perm
 
                )
 
                #check if we have permissions to alter this usergroup
 
                if HasUserGroupPermissionAny('usergroup.read', 'usergroup.write',
 
                                             'usergroup.admin')(member):
 
                    self.grant_users_group_permission(
 
                        repo=repo, group_name=member, perm=perm
 
                    )
 

	
 
    def create_fork(self, form_data, cur_user):
 
        """
 
        Simple wrapper into executing celery task for fork creation
 

	
 
        :param form_data:
 
        :param cur_user:
 
        """
 
        from rhodecode.lib.celerylib import tasks, run_task
 
        run_task(tasks.create_repo_fork, form_data, cur_user)
 

	
 
    def delete(self, repo, forks=None, fs_remove=True):
rhodecode/model/repos_group.py
Show inline comments
 
@@ -160,24 +160,25 @@ class ReposGroupModel(BaseModel):
 
                # throw any exceptions, create filesystem dirs at the very end
 
                self.sa.flush()
 
                self.__create_group(new_repos_group.group_name)
 

	
 
            return new_repos_group
 
        except Exception:
 
            log.error(traceback.format_exc())
 
            raise
 

	
 
    def _update_permissions(self, repos_group, perms_new=None,
 
                            perms_updates=None, recursive=False):
 
        from rhodecode.model.repo import RepoModel
 
        from rhodecode.lib.auth import HasUserGroupPermissionAny
 
        if not perms_new:
 
            perms_new = []
 
        if not perms_updates:
 
            perms_updates = []
 

	
 
        def _set_perm_user(obj, user, perm):
 
            if isinstance(obj, RepoGroup):
 
                self.grant_user_permission(
 
                    repos_group=obj, user=user, perm=perm
 
                )
 
            elif isinstance(obj, Repository):
 
                #we do this ONLY IF repository is non-private
 
@@ -211,31 +212,37 @@ class ReposGroupModel(BaseModel):
 
            #obj is an instance of a group or repositories in that group
 
            if not recursive:
 
                obj = repos_group
 

	
 
            # update permissions
 
            for member, perm, member_type in perms_updates:
 
                ## set for user
 
                if member_type == 'user':
 
                    # this updates also current one if found
 
                    _set_perm_user(obj, user=member, perm=perm)
 
                ## set for user group
 
                else:
 
                    _set_perm_group(obj, users_group=member, perm=perm)
 
                    #check if we have permissions to alter this usergroup
 
                    if HasUserGroupPermissionAny('usergroup.read', 'usergroup.write',
 
                                                 'usergroup.admin')(member):
 
                        _set_perm_group(obj, users_group=member, perm=perm)
 
            # set new permissions
 
            for member, perm, member_type in perms_new:
 
                if member_type == 'user':
 
                    _set_perm_user(obj, user=member, perm=perm)
 
                else:
 
                    _set_perm_group(obj, users_group=member, perm=perm)
 
                    #check if we have permissions to alter this usergroup
 
                    if HasUserGroupPermissionAny('usergroup.read', 'usergroup.write',
 
                                                 'usergroup.admin')(member):
 
                        _set_perm_group(obj, users_group=member, perm=perm)
 
            updates.append(obj)
 
            #if it's not recursive call
 
            # break the loop and don't proceed with other changes
 
            if not recursive:
 
                break
 
        return updates
 

	
 
    def update(self, repos_group, form_data):
 

	
 
        try:
 
            repos_group = self._get_repo_group(repos_group)
 
            old_path = repos_group.full_path
rhodecode/model/users_group.py
Show inline comments
 
@@ -54,50 +54,57 @@ class UserGroupModel(BaseModel):
 
                default_perm = p.permission.permission_name
 
                break
 

	
 
        user_group_to_perm = UserUserGroupToPerm()
 
        user_group_to_perm.permission = Permission.get_by_key(default_perm)
 

	
 
        user_group_to_perm.user_group = user_group
 
        user_group_to_perm.user_id = def_user.user_id
 
        return user_group_to_perm
 

	
 
    def _update_permissions(self, user_group, perms_new=None,
 
                            perms_updates=None):
 
        from rhodecode.lib.auth import HasUserGroupPermissionAny
 
        if not perms_new:
 
            perms_new = []
 
        if not perms_updates:
 
            perms_updates = []
 

	
 
        # update permissions
 
        for member, perm, member_type in perms_updates:
 
            if member_type == 'user':
 
                # this updates existing one
 
                self.grant_user_permission(
 
                    user_group=user_group, user=member, perm=perm
 
                )
 
            else:
 
                self.grant_users_group_permission(
 
                    target_user_group=user_group, user_group=member, perm=perm
 
                )
 
                #check if we have permissions to alter this usergroup
 
                if HasUserGroupPermissionAny('usergroup.read', 'usergroup.write',
 
                                             'usergroup.admin')(member):
 
                    self.grant_users_group_permission(
 
                        target_user_group=user_group, user_group=member, perm=perm
 
                    )
 
        # set new permissions
 
        for member, perm, member_type in perms_new:
 
            if member_type == 'user':
 
                self.grant_user_permission(
 
                    user_group=user_group, user=member, perm=perm
 
                )
 
            else:
 
                self.grant_users_group_permission(
 
                    target_user_group=user_group, user_group=member, perm=perm
 
                )
 
                #check if we have permissions to alter this usergroup
 
                if HasUserGroupPermissionAny('usergroup.read', 'usergroup.write',
 
                                             'usergroup.admin')(member):
 
                    self.grant_users_group_permission(
 
                        target_user_group=user_group, user_group=member, perm=perm
 
                    )
 

	
 
    def get(self, users_group_id, cache=False):
 
        return UserGroup.get(users_group_id)
 

	
 
    def get_group(self, users_group):
 
        return self._get_user_group(users_group)
 

	
 
    def get_by_name(self, name, cache=False, case_insensitive=False):
 
        return UserGroup.get_by_group_name(name, cache, case_insensitive)
 

	
 
    def create(self, name, owner, active=True):
 
        try:
0 comments (0 inline, 0 general)