Changeset - 93834966ae01
Parent rev.
Child rev.
[Not reviewed]
default
0 11 0
Mads Kiilerich - 7 years ago 2018-12-31 02:25:11
mads@kiilerich.com
auth: global permissions given to the default user are the bare minimum and should apply to *all* other users too

Drop the "subtractive permission" config option "inherit_from_default" that
when set to false would give users less global permissions than the default
unauthenticated user.

Instead, think positive and merge all positive permissions.

At the end, filter the global permissions to make sure we for each kind of
permissions only keep the one with most weight.
11 files changed with 44 insertions and 129 deletions:
kallithea/config/rcextensions/__init__.py
2
kallithea/controllers/admin/user_groups.py
2
kallithea/controllers/admin/users.py
3
kallithea/lib/auth.py
25
46
kallithea/lib/hooks.py
2
kallithea/model/db.py
2
kallithea/model/forms.py
1
kallithea/templates/admin/users/user_edit_ips.html
1
1
kallithea/templates/base/default_perms_box.html
33
kallithea/tests/functional/test_forks.py
4
5
kallithea/tests/models/test_permissions.py
14
32
0 comments (0 inline, 0 general)
kallithea/config/rcextensions/__init__.py
➞
Show inline comments
 
@@ -102,13 +102,12 @@ def _cruserhook(*args, **kwargs):
 
      :param api_key:
 
      :param last_login:
 
      :param full_name:
 
      :param active:
 
      :param password:
 
      :param emails:
 
      :param inherit_default_permissions:
 
      :param created_by:
 
    """
 
    return 0
 

			




	
	
	
		
 

			




	
	
	
		
 
CREATE_USER_HOOK = _cruserhook

			




	
	
		
 
@@ -166,13 +165,12 @@ def _dluserhook(*args, **kwargs):

			




	
	
	
		
 
      :param api_key:

			




	
	
	
		
 
      :param last_login:

			




	
	
	
		
 
      :param full_name:

			




	
	
	
		
 
      :param active:

			




	
	
	
		
 
      :param password:

			




	
	
	
		
 
      :param emails:

			




	
	
	
		
 
      :param inherit_default_permissions:

			




	
	
	
		
 
      :param deleted_by:

			




	
	
	
		
 
    """

			




	
	
	
		
 
    return 0

			




	
	
	
		
 

			




	
	
	
		
 

			




	
	
	
		
 
DELETE_USER_HOOK = _dluserhook

			




        

    


    
    

    

        

                

                    kallithea/controllers/admin/user_groups.py
                

                

                  
                      
                        

                      ➞

                      
                        
                  

                  
                      
                  
                      
                  
                      
                  
                      
                  
                  
                

                

                    Show inline comments
                    
                

        

        

            



	
	
		
 
@@ -366,14 +366,12 @@ class UserGroupsController(BaseControlle

			




	
	
	
		
 
        user_group = UserGroup.get_or_404(id)

			




	
	
	
		
 

			




	
	
	
		
 
        try:

			




	
	
	
		
 
            form = CustomDefaultPermissionsForm()()

			




	
	
	
		
 
            form_result = form.to_python(request.POST)

			




	
	
	
		
 

			




	
	
	
		
 
            inherit_perms = form_result['inherit_default_permissions']

			




	
	
	
		
 
            user_group.inherit_default_permissions = inherit_perms

			




	
	
	
		
 
            usergroup_model = UserGroupModel()

			




	
	
	
		
 

			




	
	
	
		
 
            defs = UserGroupToPerm.query() \

			




	
	
	
		
 
                .filter(UserGroupToPerm.users_group == user_group) \

			




	
	
	
		
 
                .all()

			




	
	
	
		
 
            for ug in defs:

			




        

    


    
    

    

        

                

                    kallithea/controllers/admin/users.py
                

                

                  
                      
                        

                      ➞

                      
                        
                  

                  
                      
                  
                      
                  
                      
                  
                      
                  
                  
                

                

                    Show inline comments
                    
                

        

        

            



	
	
		
 
@@ -312,14 +312,12 @@ class UsersController(BaseController):

			




	
	
	
		
 
        user = self._get_user_or_raise_if_default(id)

			




	
	
	
		
 

			




	
	
	
		
 
        try:

			




	
	
	
		
 
            form = CustomDefaultPermissionsForm()()

			




	
	
	
		
 
            form_result = form.to_python(request.POST)

			




	
	
	
		
 

			




	
	
	
		
 
            inherit_perms = form_result['inherit_default_permissions']

			




	
	
	
		
 
            user.inherit_default_permissions = inherit_perms

			




	
	
	
		
 
            user_model = UserModel()

			




	
	
	
		
 

			




	
	
	
		
 
            defs = UserToPerm.query() \

			




	
	
	
		
 
                .filter(UserToPerm.user == user) \

			




	
	
	
		
 
                .all()

			




	
	
	
		
 
            for ug in defs:

			




	
	
		
 
@@ -388,13 +386,12 @@ class UsersController(BaseController):

			




	
	
	
		
 
    def edit_ips(self, id):

			




	
	
	
		
 
        c.user = self._get_user_or_raise_if_default(id)

			




	
	
	
		
 
        c.active = 'ips'

			




	
	
	
		
 
        c.user_ip_map = UserIpMap.query() \

			




	
	
	
		
 
            .filter(UserIpMap.user == c.user).all()

			




	
	
	
		
 

			




	
	
	
		
 
        c.inherit_default_ips = c.user.inherit_default_permissions

			




	
	
	
		
 
        c.default_user_ip_map = UserIpMap.query() \

			




	
	
	
		
 
            .filter(UserIpMap.user == User.get_default_user()).all()

			




	
	
	
		
 

			




	
	
	
		
 
        defaults = c.user.get_dict()

			




	
	
	
		
 
        return htmlfill.render(

			




	
	
	
		
 
            render('admin/users/user_edit.html'),

			




        

    


    
    

    

        

                

                    kallithea/lib/auth.py
                

                

                  
                      
                        

                      ➞

                      
                        
                  

                  
                      
                  
                      
                  
                      
                  
                      
                  
                  
                

                

                    Show inline comments
                    
                

        

        

            



	
	
		
 
@@ -129,13 +129,13 @@ def check_password(password, hashed):

			




	
	
	
		
 
            return False

			




	
	
	
		
 
    else:

			




	
	
	
		
 
        raise Exception('Unknown or unsupported platform %s'

			




	
	
	
		
 
                        % __platform__)

			




	
	
	
		
 

			




	
	
	
		
 

			




	
	
	
		
 
def _cached_perms_data(user_id, user_is_admin, user_inherit_default_permissions,

			




	
	
	
		
 
def _cached_perms_data(user_id, user_is_admin,

			




	
	
	
		
 
                       explicit):

			




	
	
	
		
 
    RK = 'repositories'

			




	
	
	
		
 
    GK = 'repositories_groups'

			




	
	
	
		
 
    UK = 'user_groups'

			




	
	
	
		
 
    GLOBAL = 'global'

			




	
	
	
		
 
    PERM_WEIGHTS = Permission.PERM_WEIGHTS

			




	
	
		
 
@@ -223,20 +223,14 @@ def _cached_perms_data(user_id, user_is_

			




	
	
	
		
 
    for perm in default_user_group_perms:

			




	
	
	
		
 
        u_k = perm.UserUserGroupToPerm.user_group.users_group_name

			




	
	
	
		
 
        p = perm.Permission.permission_name

			




	
	
	
		
 
        permissions[UK][u_k] = p

			




	
	
	
		
 

			




	
	
	
		
 
    #======================================================================

			




	
	
	
		
 
    # !! OVERRIDE GLOBALS !! with user permissions if any found

			




	
	
	
		
 
    # !! Augment GLOBALS with user permissions if any found !!

			




	
	
	
		
 
    #======================================================================

			




	
	
	
		
 
    # those can be configured from groups or users explicitly

			




	
	
	
		
 
    _configurable = set([

			




	
	
	
		
 
        'hg.fork.none', 'hg.fork.repository',

			




	
	
	
		
 
        'hg.create.none', 'hg.create.repository',

			




	
	
	
		
 
        'hg.usergroup.create.false', 'hg.usergroup.create.true'

			




	
	
	
		
 
    ])

			




	
	
	
		
 

			




	
	
	
		
 
    # USER GROUPS comes first

			




	
	
	
		
 
    # user group global permissions

			




	
	
	
		
 
    user_perms_from_users_groups = Session().query(UserGroupToPerm) \

			




	
	
	
		
 
        .options(joinedload(UserGroupToPerm.permission)) \

			




	
	
	
		
 
        .join((UserGroupMember, UserGroupToPerm.users_group_id ==

			




	
	
		
 
@@ -250,36 +244,29 @@ def _cached_perms_data(user_id, user_is_

			




	
	
	
		
 
    # need to group here by groups since user can be in more than

			




	
	
	
		
 
    # one group

			




	
	
	
		
 
    _grouped = [[x, list(y)] for x, y in

			




	
	
	
		
 
                itertools.groupby(user_perms_from_users_groups,

			




	
	
	
		
 
                                  lambda x:x.users_group)]

			




	
	
	
		
 
    for gr, perms in _grouped:

			




	
	
	
		
 
        # since user can be in multiple groups iterate over them and

			




	
	
	
		
 
        # select the lowest permissions first (more explicit)

			




	
	
	
		
 
        # TODO: do this^^

			




	
	
	
		
 
        if not gr.inherit_default_permissions:

			




	
	
	
		
 
            # NEED TO IGNORE all configurable permissions and

			




	
	
	
		
 
            # replace them with explicitly set

			




	
	
	
		
 
            permissions[GLOBAL] = permissions[GLOBAL] \

			




	
	
	
		
 
                                            .difference(_configurable)

			




	
	
	
		
 
        for perm in perms:

			




	
	
	
		
 
            permissions[GLOBAL].add(perm.permission.permission_name)

			




	
	
	
		
 

			




	
	
	
		
 
    # user specific global permissions

			




	
	
	
		
 
    user_perms = Session().query(UserToPerm) \

			




	
	
	
		
 
            .options(joinedload(UserToPerm.permission)) \

			




	
	
	
		
 
            .filter(UserToPerm.user_id == user_id).all()

			




	
	
	
		
 

			




	
	
	
		
 
    if not user_inherit_default_permissions:

			




	
	
	
		
 
        # NEED TO IGNORE all configurable permissions and

			




	
	
	
		
 
        # replace them with explicitly set

			




	
	
	
		
 
        permissions[GLOBAL] = permissions[GLOBAL] \

			




	
	
	
		
 
                                        .difference(_configurable)

			




	
	
	
		
 
    for perm in user_perms:

			




	
	
	
		
 
        permissions[GLOBAL].add(perm.permission.permission_name)

			




	
	
	
		
 

			




	
	
	
		
 
        for perm in user_perms:

			




	
	
	
		
 
            permissions[GLOBAL].add(perm.permission.permission_name)

			




	
	
	
		
 
    # for each kind of global permissions, only keep the one with heighest weight

			




	
	
	
		
 
    kind_max_perm = {}

			




	
	
	
		
 
    for perm in sorted(permissions[GLOBAL], key=lambda n: PERM_WEIGHTS[n]):

			




	
	
	
		
 
        kind = perm.rsplit('.', 1)[0]

			




	
	
	
		
 
        kind_max_perm[kind] = perm

			




	
	
	
		
 
    permissions[GLOBAL] = set(kind_max_perm.values())

			




	
	
	
		
 
    ## END GLOBAL PERMISSIONS

			




	
	
	
		
 

			




	
	
	
		
 
    #======================================================================

			




	
	
	
		
 
    # !! PERMISSIONS FOR REPOSITORIES !!

			




	
	
	
		
 
    #======================================================================

			




	
	
	
		
 
    #======================================================================

			




	
	
		
 
@@ -482,13 +469,12 @@ class AuthUser(object):

			




	
	
	
		
 
        self.username = None

			




	
	
	
		
 
        self.api_key = None

			




	
	
	
		
 
        self.name = ''

			




	
	
	
		
 
        self.lastname = ''

			




	
	
	
		
 
        self.email = ''

			




	
	
	
		
 
        self.admin = False

			




	
	
	
		
 
        self.inherit_default_permissions = False

			




	
	
	
		
 

			




	
	
	
		
 
        # Look up database user, if necessary.

			




	
	
	
		
 
        if user_id is not None:

			




	
	
	
		
 
            log.debug('Auth User lookup by USER ID %s', user_id)

			




	
	
	
		
 
            dbuser = UserModel().get(user_id)

			




	
	
	
		
 
        else:

			




	
	
		
 
@@ -584,19 +570,17 @@ class AuthUser(object):

			




	
	
	
		
 
            that user is part of, explicit flag will define if user will

			




	
	
	
		
 
            explicitly override permissions from group, if it's False it will

			




	
	
	
		
 
            compute the decision

			




	
	
	
		
 
        """

			




	
	
	
		
 
        user_id = user.user_id

			




	
	
	
		
 
        user_is_admin = user.is_admin

			




	
	
	
		
 
        user_inherit_default_permissions = user.inherit_default_permissions

			




	
	
	
		
 

			




	
	
	
		
 
        log.debug('Getting PERMISSION tree')

			




	
	
	
		
 
        compute = conditional_cache('short_term', 'cache_desc',

			




	
	
	
		
 
                                    condition=cache, func=_cached_perms_data)

			




	
	
	
		
 
        return compute(user_id, user_is_admin,

			




	
	
	
		
 
                       user_inherit_default_permissions, explicit)

			




	
	
	
		
 
        return compute(user_id, user_is_admin, explicit)

			




	
	
	
		
 

			




	
	
	
		
 
    def _get_api_keys(self):

			




	
	
	
		
 
        api_keys = [self.api_key]

			




	
	
	
		
 
        for api_key in UserApiKeys.query() \

			




	
	
	
		
 
                .filter_by(user_id=self.user_id, is_expired=False):

			




	
	
	
		
 
            api_keys.append(api_key.api_key)

			




	
	
		
 
@@ -634,14 +618,13 @@ class AuthUser(object):

			




	
	
	
		
 
    @staticmethod

			




	
	
	
		
 
    def check_ip_allowed(user, ip_addr):

			




	
	
	
		
 
        """

			




	
	
	
		
 
        Check if the given IP address (a `str`) is allowed for the given

			




	
	
	
		
 
        user (an `AuthUser` or `db.User`).

			




	
	
	
		
 
        """

			




	
	
	
		
 
        allowed_ips = AuthUser.get_allowed_ips(user.user_id, cache=True,

			




	
	
	
		
 
            inherit_from_default=user.inherit_default_permissions)

			




	
	
	
		
 
        allowed_ips = AuthUser.get_allowed_ips(user.user_id, cache=True)

			




	
	
	
		
 
        if check_ip_access(source_ip=ip_addr, allowed_ips=allowed_ips):

			




	
	
	
		
 
            log.debug('IP:%s is in range of %s', ip_addr, allowed_ips)

			




	
	
	
		
 
            return True

			




	
	
	
		
 
        else:

			




	
	
	
		
 
            log.info('Access for IP:%s forbidden, '

			




	
	
	
		
 
                     'not in %s' % (ip_addr, allowed_ips))

			




	
	
		
 
@@ -669,36 +652,32 @@ class AuthUser(object):

			




	
	
	
		
 
            is_external_auth=cookie.get('is_external_auth', False),

			




	
	
	
		
 
        )

			




	
	
	
		
 
        au.is_authenticated = True

			




	
	
	
		
 
        return au

			




	
	
	
		
 

			




	
	
	
		
 
    @classmethod

			




	
	
	
		
 
    def get_allowed_ips(cls, user_id, cache=False, inherit_from_default=False):

			




	
	
	
		
 
    def get_allowed_ips(cls, user_id, cache=False):

			




	
	
	
		
 
        _set = set()

			




	
	
	
		
 

			




	
	
	
		
 
        if inherit_from_default:

			




	
	
	
		
 
            default_ips = UserIpMap.query().filter(UserIpMap.user_id ==

			




	
	
	
		
 
                                            User.get_default_user(cache=True).user_id)

			




	
	
	
		
 
            if cache:

			




	
	
	
		
 
                default_ips = default_ips.options(FromCache("sql_cache_short",

			




	
	
	
		
 
                                                  "get_user_ips_default"))

			




	
	
	
		
 

			




	
	
	
		
 
            # populate from default user

			




	
	
	
		
 
            for ip in default_ips:

			




	
	
	
		
 
                try:

			




	
	
	
		
 
                    _set.add(ip.ip_addr)

			




	
	
	
		
 
                except ObjectDeletedError:

			




	
	
	
		
 
                    # since we use heavy caching sometimes it happens that we get

			




	
	
	
		
 
                    # deleted objects here, we just skip them

			




	
	
	
		
 
                    pass

			




	
	
	
		
 
        default_ips = UserIpMap.query().filter(UserIpMap.user_id ==

			




	
	
	
		
 
                                        User.get_default_user(cache=True).user_id)

			




	
	
	
		
 
        if cache:

			




	
	
	
		
 
            default_ips = default_ips.options(FromCache("sql_cache_short",

			




	
	
	
		
 
                                              "get_user_ips_default"))

			




	
	
	
		
 
        for ip in default_ips:

			




	
	
	
		
 
            try:

			




	
	
	
		
 
                _set.add(ip.ip_addr)

			




	
	
	
		
 
            except ObjectDeletedError:

			




	
	
	
		
 
                # since we use heavy caching sometimes it happens that we get

			




	
	
	
		
 
                # deleted objects here, we just skip them

			




	
	
	
		
 
                pass

			




	
	
	
		
 

			




	
	
	
		
 
        user_ips = UserIpMap.query().filter(UserIpMap.user_id == user_id)

			




	
	
	
		
 
        if cache:

			




	
	
	
		
 
            user_ips = user_ips.options(FromCache("sql_cache_short",

			




	
	
	
		
 
                                                  "get_user_ips_%s" % user_id))

			




	
	
	
		
 

			




	
	
	
		
 
        for ip in user_ips:

			




	
	
	
		
 
            try:

			




	
	
	
		
 
                _set.add(ip.ip_addr)

			




	
	
	
		
 
            except ObjectDeletedError:

			




	
	
	
		
 
                # since we use heavy caching sometimes it happens that we get

			




	
	
	
		
 
                # deleted objects here, we just skip them

			




        

    


    
    

    

        

                

                    kallithea/lib/hooks.py
                

                

                  
                      
                        

                      ➞

                      
                        
                  

                  
                      
                  
                      
                  
                      
                  
                      
                  
                  
                

                

                    Show inline comments
                    
                

        

        

            



	
	
		
 
@@ -209,13 +209,12 @@ def log_create_user(user_dict, created_b

			




	
	
	
		
 
     'api_key',

			




	
	
	
		
 
     'last_login',

			




	
	
	
		
 
     'full_name',

			




	
	
	
		
 
     'active',

			




	
	
	
		
 
     'password',

			




	
	
	
		
 
     'emails',

			




	
	
	
		
 
     'inherit_default_permissions'

			




	
	
	
		
 

			




	
	
	
		
 
    """

			




	
	
	
		
 
    from kallithea import EXTENSIONS

			




	
	
	
		
 
    callback = getattr(EXTENSIONS, 'CREATE_USER_HOOK', None)

			




	
	
	
		
 
    if callable(callback):

			




	
	
	
		
 
        return callback(created_by=created_by, **user_dict)

			




	
	
		
 
@@ -282,13 +281,12 @@ def log_delete_user(user_dict, deleted_b

			




	
	
	
		
 
     'api_key',

			




	
	
	
		
 
     'last_login',

			




	
	
	
		
 
     'full_name',

			




	
	
	
		
 
     'active',

			




	
	
	
		
 
     'password',

			




	
	
	
		
 
     'emails',

			




	
	
	
		
 
     'inherit_default_permissions'

			




	
	
	
		
 

			




	
	
	
		
 
    """

			




	
	
	
		
 
    from kallithea import EXTENSIONS

			




	
	
	
		
 
    callback = getattr(EXTENSIONS, 'DELETE_USER_HOOK', None)

			




	
	
	
		
 
    if callable(callback):

			




	
	
	
		
 
        return callback(deleted_by=deleted_by, **user_dict)

			




        

    


    
    

    

        

                

                    kallithea/model/db.py
                

                

                  
                      
                        

                      ➞

                      
                        
                  

                  
                      
                  
                      
                  
                      
                  
                      
                  
                  
                

                

                    Show inline comments
                    
                

        

        

            



	
	
		
 
@@ -423,13 +423,12 @@ class User(Base, BaseDbModel):

			




	
	
	
		
 
    lastname = Column(Unicode(255), nullable=False)

			




	
	
	
		
 
    _email = Column("email", String(255), nullable=True, unique=True) # FIXME: not nullable?

			




	
	
	
		
 
    last_login = Column(DateTime(timezone=False), nullable=True)

			




	
	
	
		
 
    extern_type = Column(String(255), nullable=True) # FIXME: not nullable?

			




	
	
	
		
 
    extern_name = Column(String(255), nullable=True) # FIXME: not nullable?

			




	
	
	
		
 
    api_key = Column(String(255), nullable=False)

			




	
	
	
		
 
    inherit_default_permissions = Column(Boolean(), nullable=False, default=True)

			




	
	
	
		
 
    created_on = Column(DateTime(timezone=False), nullable=False, default=datetime.datetime.now)

			




	
	
	
		
 
    _user_data = Column("user_data", LargeBinary(), nullable=True)  # JSON data # FIXME: not nullable?

			




	
	
	
		
 

			




	
	
	
		
 
    user_log = relationship('UserLog')

			




	
	
	
		
 
    user_perms = relationship('UserToPerm', primaryjoin="User.user_id==UserToPerm.user_id", cascade='all')

			




	
	
	
		
 

			




	
	
		
 
@@ -817,13 +816,12 @@ class UserGroup(Base, BaseDbModel):

			




	
	
	
		
 
    )

			




	
	
	
		
 

			




	
	
	
		
 
    users_group_id = Column(Integer(), primary_key=True)

			




	
	
	
		
 
    users_group_name = Column(Unicode(255), nullable=False, unique=True)

			




	
	
	
		
 
    user_group_description = Column(Unicode(10000), nullable=True) # FIXME: not nullable?

			




	
	
	
		
 
    users_group_active = Column(Boolean(), nullable=False)

			




	
	
	
		
 
    inherit_default_permissions = Column("users_group_inherit_default_permissions", Boolean(), nullable=False, default=True)

			




	
	
	
		
 
    owner_id = Column('user_id', Integer(), ForeignKey('users.user_id'), nullable=False)

			




	
	
	
		
 
    created_on = Column(DateTime(timezone=False), nullable=False, default=datetime.datetime.now)

			




	
	
	
		
 
    _group_data = Column("group_data", LargeBinary(), nullable=True)  # JSON data # FIXME: not nullable?

			




	
	
	
		
 

			




	
	
	
		
 
    members = relationship('UserGroupMember', cascade="all, delete-orphan")

			




	
	
	
		
 
    users_group_to_perm = relationship('UserGroupToPerm', cascade='all')

			




        

    


    
    

    

        

                

                    kallithea/model/forms.py
                

                

                  
                      
                        

                      ➞

                      
                        
                  

                  
                      
                  
                      
                  
                      
                  
                      
                  
                  
                

                

                    Show inline comments
                    
                

        

        

            



	
	
		
 
@@ -421,13 +421,12 @@ def DefaultPermissionsForm(repo_perms_ch

			




	
	
	
		
 

			




	
	
	
		
 

			




	
	
	
		
 
def CustomDefaultPermissionsForm():

			




	
	
	
		
 
    class _CustomDefaultPermissionsForm(formencode.Schema):

			




	
	
	
		
 
        filter_extra_fields = True

			




	
	
	
		
 
        allow_extra_fields = True

			




	
	
	
		
 
        inherit_default_permissions = v.StringBoolean(if_missing=False)

			




	
	
	
		
 

			




	
	
	
		
 
        create_repo_perm = v.StringBoolean(if_missing=False)

			




	
	
	
		
 
        create_user_group_perm = v.StringBoolean(if_missing=False)

			




	
	
	
		
 
        #create_repo_group_perm Impl. later

			




	
	
	
		
 

			




	
	
	
		
 
        fork_repo_perm = v.StringBoolean(if_missing=False)

			




        

    


    
    

    

        

                

                    kallithea/templates/admin/users/user_edit_ips.html
                

                

                  
                      
                        

                      ➞

                      
                        
                  

                  
                      
                  
                      
                  
                      
                  
                      
                  
                  
                

                

                    Show inline comments
                    
                

        

        

            



	
	
	
		
 
<table class="table">

			




	
	
	
		
 
    %if c.default_user_ip_map and c.inherit_default_ips:

			




	
	
	
		
 
    %if c.default_user_ip_map:

			




	
	
	
		
 
        %for ip in c.default_user_ip_map:

			




	
	
	
		
 
          <tr>

			




	
	
	
		
 
            <td><div class="ip">${ip.ip_addr}</div></td>

			




	
	
	
		
 
            <td><div class="ip">${h.ip_range(ip.ip_addr)}</div></td>

			




	
	
	
		
 
            <td>${h.HTML(_('Inherited from %s')) % h.link_to('*default*',h.url('admin_permissions_ips'))}</td>

			




	
	
	
		
 
          </tr>

			




        

    


    
    

    

        

                

                    kallithea/templates/base/default_perms_box.html
                

                

                  
                      
                        

                      ➞

                      
                        
                  

                  
                      
                  
                      
                  
                      
                  
                      
                  
                  
                

                

                    Show inline comments
                    
                

        

        

            



	
	
		
 
@@ -5,24 +5,12 @@

			




	
	
	
		
 

			




	
	
	
		
 

			




	
	
	
		
 
<%def name="default_perms_box(form_url)">

			




	
	
	
		
 
${h.form(form_url)}

			




	
	
	
		
 
    <div class="form">

			




	
	
	
		
 
            <div class="form-group">

			




	
	
	
		
 
                <label class="control-label" for="inherit_default_permissions">${_('Inherit defaults')}:</label>

			




	
	
	
		
 
                <div>

			




	
	
	
		
 
                    ${h.checkbox('inherit_default_permissions',value=True)}

			




	
	
	
		
 
                    <span class="help-block">

			




	
	
	
		
 
                        ${(h.HTML(_('Select to inherit global settings, IP whitelist and permissions from the %s.'))

			




	
	
	
		
 
                                % h.link_to(_('default permissions'), url('admin_permissions')))}

			




	
	
	
		
 
                    </span>

			




	
	
	
		
 
                </div>

			




	
	
	
		
 
            </div>

			




	
	
	
		
 

			




	
	
	
		
 
            <div id="inherit_overlay">

			




	
	
	
		
 
            <div class="form-group">

			




	
	
	
		
 
                <label class="control-label" for="create_repo_perm">${_('Create repositories')}:</label>

			




	
	
	
		
 
                <div>

			




	
	
	
		
 
                    ${h.checkbox('create_repo_perm',value=True)}

			




	
	
	
		
 
                    <span class="help-block">

			




	
	
	
		
 
                        ${_('Select this option to allow repository creation for this user')}

			




	
	
	
		
 
                    </span>

			




	
	
		
 
@@ -46,36 +34,15 @@ ${h.form(form_url)}

			




	
	
	
		
 
                    <span class="help-block">

			




	
	
	
		
 
                        ${_('Select this option to allow repository forking for this user')}

			




	
	
	
		
 
                    </span>

			




	
	
	
		
 
                </div>

			




	
	
	
		
 
            </div>

			




	
	
	
		
 

			




	
	
	
		
 
            </div>

			




	
	
	
		
 

			




	
	
	
		
 
            <div class="form-group">

			




	
	
	
		
 
                <div class="buttons">

			




	
	
	
		
 
                    ${h.submit('save',_('Save'),class_="btn btn-default")}

			




	
	
	
		
 
                    ${h.reset('reset',_('Reset'),class_="btn btn-default")}

			




	
	
	
		
 
                </div>

			




	
	
	
		
 
            </div>

			




	
	
	
		
 
    </div>

			




	
	
	
		
 
${h.end_form()}

			




	
	
	
		
 

			




	
	
	
		
 
## JS

			




	
	
	
		
 
<script>

			




	
	
	
		
 
$(document).ready(function(e){

			




	
	
	
		
 
    var show_custom_perms = function(inherit_default){

			




	
	
	
		
 
        if(inherit_default){

			




	
	
	
		
 
            $('#inherit_overlay').hide();

			




	
	
	
		
 
        }else{

			




	
	
	
		
 
            $('#inherit_overlay').show();

			




	
	
	
		
 
        }

			




	
	
	
		
 
    };

			




	
	
	
		
 

			




	
	
	
		
 
    show_custom_perms($('#inherit_default_permissions').prop('checked'));

			




	
	
	
		
 
    $('#inherit_default_permissions').change(function(){

			




	
	
	
		
 
        show_custom_perms($('#inherit_default_permissions').prop('checked'));

			




	
	
	
		
 
    });

			




	
	
	
		
 
});

			




	
	
	
		
 
</script>

			




	
	
	
		
 

			




	
	
	
		
 
</%def>

			




        

    


    
    

    

        

                

                    kallithea/tests/functional/test_forks.py
                

                

                  
                      
                        

                      ➞

                      
                        
                  

                  
                      
                  
                      
                  
                      
                  
                      
                  
                  
                

                

                    Show inline comments
                    
                

        

        

            



	
	
		
 
@@ -4,13 +4,13 @@ import urllib

			




	
	
	
		
 
import unittest

			




	
	
	
		
 

			




	
	
	
		
 
from kallithea.tests.base import *

			




	
	
	
		
 
from kallithea.tests.fixture import Fixture

			




	
	
	
		
 

			




	
	
	
		
 
from kallithea.lib.utils2 import safe_str, safe_unicode

			




	
	
	
		
 
from kallithea.model.db import Repository

			




	
	
	
		
 
from kallithea.model.db import Repository, User

			




	
	
	
		
 
from kallithea.model.repo import RepoModel

			




	
	
	
		
 
from kallithea.model.user import UserModel

			




	
	
	
		
 
from kallithea.model.meta import Session

			




	
	
	
		
 

			




	
	
	
		
 
fixture = Fixture()

			




	
	
	
		
 

			




	
	
		
 
@@ -41,26 +41,25 @@ class _BaseTestCase(TestController):

			




	
	
	
		
 
        response = self.app.get(url(controller='forks', action='forks',

			




	
	
	
		
 
                                    repo_name=repo_name))

			




	
	
	
		
 

			




	
	
	
		
 
        response.mustcontain("""There are no forks yet""")

			




	
	
	
		
 

			




	
	
	
		
 
    def test_no_permissions_to_fork(self):

			




	
	
	
		
 
        usr = self.log_user(TEST_USER_REGULAR_LOGIN,

			




	
	
	
		
 
                            TEST_USER_REGULAR_PASS)['user_id']

			




	
	
	
		
 
        self.log_user(TEST_USER_REGULAR_LOGIN, TEST_USER_REGULAR_PASS)['user_id']

			




	
	
	
		
 
        try:

			




	
	
	
		
 
            user_model = UserModel()

			




	
	
	
		
 
            usr = User.get_default_user()

			




	
	
	
		
 
            user_model.revoke_perm(usr, 'hg.fork.repository')

			




	
	
	
		
 
            user_model.grant_perm(usr, 'hg.fork.none')

			




	
	
	
		
 
            u = UserModel().get(usr)

			




	
	
	
		
 
            u.inherit_default_permissions = False

			




	
	
	
		
 
            Session().commit()

			




	
	
	
		
 
            # try create a fork

			




	
	
	
		
 
            repo_name = self.REPO

			




	
	
	
		
 
            self.app.post(url(controller='forks', action='fork_create',

			




	
	
	
		
 
                              repo_name=repo_name), {'_authentication_token': self.authentication_token()}, status=403)

			




	
	
	
		
 
        finally:

			




	
	
	
		
 
            usr = User.get_default_user()

			




	
	
	
		
 
            user_model.revoke_perm(usr, 'hg.fork.none')

			




	
	
	
		
 
            user_model.grant_perm(usr, 'hg.fork.repository')

			




	
	
	
		
 
            Session().commit()

			




	
	
	
		
 

			




	
	
	
		
 
    def test_index_with_fork(self):

			




	
	
	
		
 
        self.log_user()

			




        

    


    
    

    

        

                

                    kallithea/tests/models/test_permissions.py
                

                

                  
                      
                        

                      ➞

                      
                        
                  

                  
                      
                  
                      
                  
                      
                  
                      
                  
                  
                

                

                    Show inline comments
                    
                

        

        

            



	
	
		
 
@@ -307,51 +307,47 @@ class TestPermissions(TestController):

			




	
	
	
		
 

			




	
	
	
		
 
        assert a1_auth.permissions['repositories_groups'] == {u'group1': u'group.none'}

			




	
	
	
		
 

			




	
	
	
		
 
        u1_auth = AuthUser(user_id=self.u1.user_id)

			




	
	
	
		
 
        assert u1_auth.permissions['repositories_groups'] == {u'group1': u'group.read'}

			




	
	
	
		
 

			




	
	
	
		
 
    def test_inherited_permissions_from_default_on_user_enabled(self):

			




	
	
	
		
 
    def test_inherit_nice_permissions_from_default_user(self):

			




	
	
	
		
 
        user_model = UserModel()

			




	
	
	
		
 
        # enable fork and create on default user

			




	
	
	
		
 
        usr = 'default'

			




	
	
	
		
 
        user_model.revoke_perm(usr, 'hg.create.none')

			




	
	
	
		
 
        user_model.grant_perm(usr, 'hg.create.repository')

			




	
	
	
		
 
        user_model.revoke_perm(usr, 'hg.fork.none')

			




	
	
	
		
 
        user_model.grant_perm(usr, 'hg.fork.repository')

			




	
	
	
		
 
        # make sure inherit flag is turned on

			




	
	
	
		
 
        self.u1.inherit_default_permissions = True

			




	
	
	
		
 
        Session().commit()

			




	
	
	
		
 
        u1_auth = AuthUser(user_id=self.u1.user_id)

			




	
	
	
		
 
        # this user will have inherited permissions from default user

			




	
	
	
		
 
        assert u1_auth.permissions['global'] == set(['hg.create.repository', 'hg.fork.repository',

			




	
	
	
		
 
                              'hg.register.manual_activate',

			




	
	
	
		
 
                              'hg.extern_activate.auto',

			




	
	
	
		
 
                              'repository.read', 'group.read',

			




	
	
	
		
 
                              'usergroup.read', 'hg.create.write_on_repogroup.true'])

			




	
	
	
		
 

			




	
	
	
		
 
    def test_inherited_permissions_from_default_on_user_disabled(self):

			




	
	
	
		
 
    def test_inherit_sad_permissions_from_default_user(self):

			




	
	
	
		
 
        user_model = UserModel()

			




	
	
	
		
 
        # disable fork and create on default user

			




	
	
	
		
 
        usr = 'default'

			




	
	
	
		
 
        user_model.revoke_perm(usr, 'hg.create.repository')

			




	
	
	
		
 
        user_model.grant_perm(usr, 'hg.create.none')

			




	
	
	
		
 
        user_model.revoke_perm(usr, 'hg.fork.repository')

			




	
	
	
		
 
        user_model.grant_perm(usr, 'hg.fork.none')

			




	
	
	
		
 
        # make sure inherit flag is turned on

			




	
	
	
		
 
        self.u1.inherit_default_permissions = True

			




	
	
	
		
 
        Session().commit()

			




	
	
	
		
 
        u1_auth = AuthUser(user_id=self.u1.user_id)

			




	
	
	
		
 
        # this user will have inherited permissions from default user

			




	
	
	
		
 
        assert u1_auth.permissions['global'] == set(['hg.create.none', 'hg.fork.none',

			




	
	
	
		
 
                              'hg.register.manual_activate',

			




	
	
	
		
 
                              'hg.extern_activate.auto',

			




	
	
	
		
 
                              'repository.read', 'group.read',

			




	
	
	
		
 
                              'usergroup.read', 'hg.create.write_on_repogroup.true'])

			




	
	
	
		
 

			




	
	
	
		
 
    def test_non_inherited_permissions_from_default_on_user_enabled(self):

			




	
	
	
		
 
    def test_inherit_more_permissions_from_default_user(self):

			




	
	
	
		
 
        user_model = UserModel()

			




	
	
	
		
 
        # enable fork and create on default user

			




	
	
	
		
 
        usr = 'default'

			




	
	
	
		
 
        user_model.revoke_perm(usr, 'hg.create.none')

			




	
	
	
		
 
        user_model.grant_perm(usr, 'hg.create.repository')

			




	
	
	
		
 
        user_model.revoke_perm(usr, 'hg.fork.none')

			




	
	
		
 
@@ -360,25 +356,24 @@ class TestPermissions(TestController):

			




	
	
	
		
 
        # disable global perms on specific user

			




	
	
	
		
 
        user_model.revoke_perm(self.u1, 'hg.create.repository')

			




	
	
	
		
 
        user_model.grant_perm(self.u1, 'hg.create.none')

			




	
	
	
		
 
        user_model.revoke_perm(self.u1, 'hg.fork.repository')

			




	
	
	
		
 
        user_model.grant_perm(self.u1, 'hg.fork.none')

			




	
	
	
		
 

			




	
	
	
		
 
        # make sure inherit flag is turned off

			




	
	
	
		
 
        self.u1.inherit_default_permissions = False

			




	
	
	
		
 
        Session().commit()

			




	
	
	
		
 
        u1_auth = AuthUser(user_id=self.u1.user_id)

			




	
	
	
		
 
        # this user will have non inherited permissions from he's

			




	
	
	
		
 
        # explicitly set permissions

			




	
	
	
		
 
        assert u1_auth.permissions['global'] == set(['hg.create.none', 'hg.fork.none',

			




	
	
	
		
 
        # this user will have inherited more permissions from default user

			




	
	
	
		
 
        assert u1_auth.permissions['global'] == set([

			




	
	
	
		
 
                              'hg.create.repository',

			




	
	
	
		
 
                              'hg.fork.repository',

			




	
	
	
		
 
                              'hg.register.manual_activate',

			




	
	
	
		
 
                              'hg.extern_activate.auto',

			




	
	
	
		
 
                              'repository.read', 'group.read',

			




	
	
	
		
 
                              'usergroup.read', 'hg.create.write_on_repogroup.true'])

			




	
	
	
		
 

			




	
	
	
		
 
    def test_non_inherited_permissions_from_default_on_user_disabled(self):

			




	
	
	
		
 
    def test_inherit_less_permissions_from_default_user(self):

			




	
	
	
		
 
        user_model = UserModel()

			




	
	
	
		
 
        # disable fork and create on default user

			




	
	
	
		
 
        usr = 'default'

			




	
	
	
		
 
        user_model.revoke_perm(usr, 'hg.create.repository')

			




	
	
	
		
 
        user_model.grant_perm(usr, 'hg.create.none')

			




	
	
	
		
 
        user_model.revoke_perm(usr, 'hg.fork.repository')

			




	
	
		
 
@@ -387,31 +382,27 @@ class TestPermissions(TestController):

			




	
	
	
		
 
        # enable global perms on specific user

			




	
	
	
		
 
        user_model.revoke_perm(self.u1, 'hg.create.none')

			




	
	
	
		
 
        user_model.grant_perm(self.u1, 'hg.create.repository')

			




	
	
	
		
 
        user_model.revoke_perm(self.u1, 'hg.fork.none')

			




	
	
	
		
 
        user_model.grant_perm(self.u1, 'hg.fork.repository')

			




	
	
	
		
 

			




	
	
	
		
 
        # make sure inherit flag is turned off

			




	
	
	
		
 
        self.u1.inherit_default_permissions = False

			




	
	
	
		
 
        Session().commit()

			




	
	
	
		
 
        u1_auth = AuthUser(user_id=self.u1.user_id)

			




	
	
	
		
 
        # this user will have non inherited permissions from he's

			




	
	
	
		
 
        # explicitly set permissions

			




	
	
	
		
 
        assert u1_auth.permissions['global'] == set(['hg.create.repository', 'hg.fork.repository',

			




	
	
	
		
 
        # this user will have inherited less permissions from default user

			




	
	
	
		
 
        assert u1_auth.permissions['global'] == set([

			




	
	
	
		
 
                              'hg.create.repository',

			




	
	
	
		
 
                              'hg.fork.repository',

			




	
	
	
		
 
                              'hg.register.manual_activate',

			




	
	
	
		
 
                              'hg.extern_activate.auto',

			




	
	
	
		
 
                              'repository.read', 'group.read',

			




	
	
	
		
 
                              'usergroup.read', 'hg.create.write_on_repogroup.true'])

			




	
	
	
		
 

			




	
	
	
		
 
    def test_inactive_user_group_does_not_affect_global_permissions(self):

			




	
	
	
		
 
        # Issue #138: Inactive User Groups affecting permissions

			




	
	
	
		
 
        # Add user to inactive user group, set specific permissions on user

			




	
	
	
		
 
        # group and disable inherit-from-default. User permissions should still

			




	
	
	
		
 
        # inherit from default.

			




	
	
	
		
 
        # group and and verify it really is inactive.

			




	
	
	
		
 
        self.ug1 = fixture.create_user_group(u'G1')

			




	
	
	
		
 
        self.ug1.inherit_default_permissions = False

			




	
	
	
		
 
        user_group_model = UserGroupModel()

			




	
	
	
		
 
        user_group_model.add_user_to_group(self.ug1, self.u1)

			




	
	
	
		
 
        user_group_model.update(self.ug1, {'users_group_active': False})

			




	
	
	
		
 

			




	
	
	
		
 
        # enable fork and create on user group

			




	
	
	
		
 
        user_group_model.revoke_perm(self.ug1, perm='hg.create.none')

			




	
	
		
 
@@ -435,18 +426,15 @@ class TestPermissions(TestController):

			




	
	
	
		
 
                              'hg.extern_activate.auto',

			




	
	
	
		
 
                              'repository.read', 'group.read',

			




	
	
	
		
 
                              'usergroup.read',

			




	
	
	
		
 
                              'hg.create.write_on_repogroup.true'])

			




	
	
	
		
 

			




	
	
	
		
 
    def test_inactive_user_group_does_not_affect_global_permissions_inverse(self):

			




	
	
	
		
 
        # Issue #138: Inactive User Groups affecting permissions

			




	
	
	
		
 
        # Add user to inactive user group, set specific permissions on user

			




	
	
	
		
 
        # group and disable inherit-from-default. User permissions should still

			




	
	
	
		
 
        # inherit from default.

			




	
	
	
		
 
        # group and and verify it really is inactive.

			




	
	
	
		
 
        self.ug1 = fixture.create_user_group(u'G1')

			




	
	
	
		
 
        self.ug1.inherit_default_permissions = False

			




	
	
	
		
 
        user_group_model = UserGroupModel()

			




	
	
	
		
 
        user_group_model.add_user_to_group(self.ug1, self.u1)

			




	
	
	
		
 
        user_group_model.update(self.ug1, {'users_group_active': False})

			




	
	
	
		
 

			




	
	
	
		
 
        # disable fork and create on user group

			




	
	
	
		
 
        user_group_model.revoke_perm(self.ug1, perm='hg.create.repository')

			




	
	
		
 
@@ -471,13 +459,12 @@ class TestPermissions(TestController):

			




	
	
	
		
 
                              'repository.read', 'group.read',

			




	
	
	
		
 
                              'usergroup.read',

			




	
	
	
		
 
                              'hg.create.write_on_repogroup.true'])

			




	
	
	
		
 

			




	
	
	
		
 
    def test_inactive_user_group_does_not_affect_repo_permissions(self):

			




	
	
	
		
 
        self.ug1 = fixture.create_user_group(u'G1')

			




	
	
	
		
 
        self.ug1.inherit_default_permissions = False

			




	
	
	
		
 
        user_group_model = UserGroupModel()

			




	
	
	
		
 
        user_group_model.add_user_to_group(self.ug1, self.u1)

			




	
	
	
		
 
        user_group_model.update(self.ug1, {'users_group_active': False})

			




	
	
	
		
 

			




	
	
	
		
 
        # note: make u2 repo owner rather than u1, because the owner always has

			




	
	
	
		
 
        # admin permissions

			




	
	
		
 
@@ -496,13 +483,12 @@ class TestPermissions(TestController):

			




	
	
	
		
 
        Session().commit()

			




	
	
	
		
 
        u1_auth = AuthUser(user_id=self.u1.user_id)

			




	
	
	
		
 
        assert u1_auth.permissions['repositories']['myownrepo'] == 'repository.write'

			




	
	
	
		
 

			




	
	
	
		
 
    def test_inactive_user_group_does_not_affect_repo_permissions_inverse(self):

			




	
	
	
		
 
        self.ug1 = fixture.create_user_group(u'G1')

			




	
	
	
		
 
        self.ug1.inherit_default_permissions = False

			




	
	
	
		
 
        user_group_model = UserGroupModel()

			




	
	
	
		
 
        user_group_model.add_user_to_group(self.ug1, self.u1)

			




	
	
	
		
 
        user_group_model.update(self.ug1, {'users_group_active': False})

			




	
	
	
		
 

			




	
	
	
		
 
        # note: make u2 repo owner rather than u1, because the owner always has

			




	
	
	
		
 
        # admin permissions

			




	
	
		
 
@@ -521,13 +507,12 @@ class TestPermissions(TestController):

			




	
	
	
		
 
        Session().commit()

			




	
	
	
		
 
        u1_auth = AuthUser(user_id=self.u1.user_id)

			




	
	
	
		
 
        assert u1_auth.permissions['repositories']['myownrepo'] == 'repository.admin'

			




	
	
	
		
 

			




	
	
	
		
 
    def test_inactive_user_group_does_not_affect_repo_group_permissions(self):

			




	
	
	
		
 
        self.ug1 = fixture.create_user_group(u'G1')

			




	
	
	
		
 
        self.ug1.inherit_default_permissions = False

			




	
	
	
		
 
        user_group_model = UserGroupModel()

			




	
	
	
		
 
        user_group_model.add_user_to_group(self.ug1, self.u1)

			




	
	
	
		
 
        user_group_model.update(self.ug1, {'users_group_active': False})

			




	
	
	
		
 

			




	
	
	
		
 
        self.g1 = fixture.create_repo_group(u'group1', skip_if_exists=True)

			




	
	
	
		
 

			




	
	
		
 
@@ -542,13 +527,12 @@ class TestPermissions(TestController):

			




	
	
	
		
 
        Session().commit()

			




	
	
	
		
 
        u1_auth = AuthUser(user_id=self.u1.user_id)

			




	
	
	
		
 
        assert u1_auth.permissions['repositories_groups'] == {u'group1': u'group.write'}

			




	
	
	
		
 

			




	
	
	
		
 
    def test_inactive_user_group_does_not_affect_repo_group_permissions_inverse(self):

			




	
	
	
		
 
        self.ug1 = fixture.create_user_group(u'G1')

			




	
	
	
		
 
        self.ug1.inherit_default_permissions = False

			




	
	
	
		
 
        user_group_model = UserGroupModel()

			




	
	
	
		
 
        user_group_model.add_user_to_group(self.ug1, self.u1)

			




	
	
	
		
 
        user_group_model.update(self.ug1, {'users_group_active': False})

			




	
	
	
		
 

			




	
	
	
		
 
        self.g1 = fixture.create_repo_group(u'group1', skip_if_exists=True)

			




	
	
	
		
 

			




	
	
		
 
@@ -563,13 +547,12 @@ class TestPermissions(TestController):

			




	
	
	
		
 
        Session().commit()

			




	
	
	
		
 
        u1_auth = AuthUser(user_id=self.u1.user_id)

			




	
	
	
		
 
        assert u1_auth.permissions['repositories_groups'] == {u'group1': u'group.admin'}

			




	
	
	
		
 

			




	
	
	
		
 
    def test_inactive_user_group_does_not_affect_user_group_permissions(self):

			




	
	
	
		
 
        self.ug1 = fixture.create_user_group(u'G1')

			




	
	
	
		
 
        self.ug1.inherit_default_permissions = False

			




	
	
	
		
 
        user_group_model = UserGroupModel()

			




	
	
	
		
 
        user_group_model.add_user_to_group(self.ug1, self.u1)

			




	
	
	
		
 
        user_group_model.update(self.ug1, {'users_group_active': False})

			




	
	
	
		
 

			




	
	
	
		
 
        self.ug2 = fixture.create_user_group(u'G2')

			




	
	
	
		
 

			




	
	
		
 
@@ -585,13 +568,12 @@ class TestPermissions(TestController):

			




	
	
	
		
 
        u1_auth = AuthUser(user_id=self.u1.user_id)

			




	
	
	
		
 
        assert u1_auth.permissions['user_groups'][u'G1'] == u'usergroup.read'

			




	
	
	
		
 
        assert u1_auth.permissions['user_groups'][u'G2'] == u'usergroup.write'

			




	
	
	
		
 

			




	
	
	
		
 
    def test_inactive_user_group_does_not_affect_user_group_permissions_inverse(self):

			




	
	
	
		
 
        self.ug1 = fixture.create_user_group(u'G1')

			




	
	
	
		
 
        self.ug1.inherit_default_permissions = False

			




	
	
	
		
 
        user_group_model = UserGroupModel()

			




	
	
	
		
 
        user_group_model.add_user_to_group(self.ug1, self.u1)

			




	
	
	
		
 
        user_group_model.update(self.ug1, {'users_group_active': False})

			




	
	
	
		
 

			




	
	
	
		
 
        self.ug2 = fixture.create_user_group(u'G2')

			




	
	
	
		
 

			




        

    



    


    



    



      

      





    
    0 comments (0 inline, 0 general)
    





    


  

  







  


    




    








    
        
    
    
        This site is powered by
            Kallithea 0.7.0,
        which is
        © 2010–2025 by various authors & licensed under GPLv3.