application/piki
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Fix access for attachments

Browse Source
This commit is contained in:
Dirk Alders 2024-10-21 18:45:35 +02:00
parent b8606bc0b5
commit e7c60df5df
1 changed files with 7 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
pages/access.py
View File

@ -1,5 +1,6 @@
from django.conf import settings from django.conf import settings
import logging import logging
import os
from .models import PikiPage from .models import PikiPage
@ -31,11 +32,11 @@ class access_control(object):
elif self._page is None: elif self._page is None:
if self._user.is_staff: if self._user.is_staff:
# Page creation is allowed for staff users # Page creation is allowed for staff users
logger.debug("Page does not exist and user is staff -> full access granted") logger.debug("Page %s does not exist and user is staff -> full access granted", repr(self._rel_path))
self._read = True self._read = True
self._write = True self._write = True
else: else:
logger.debug("Page does not exist and user is not staff -> no access granted") logger.debug("Page %s does not exist and user is not staff -> no access granted", repr(self._rel_path))
else: else:
user_is_owner = self._page.owner == self._user user_is_owner = self._page.owner == self._user
user_in_page_group = self._page.group in self._user.groups.all() user_in_page_group = self._page.group in self._user.groups.all()
@ -75,11 +76,13 @@ class access_control(object):
return self.may_write() return self.may_write()
def read_attachment(request, rel_path): def read_attachment(request, path):
# Interface for external module mycreole # Interface for external module mycreole
rel_path = os.path.dirname(path)
return access_control(request, rel_path).may_read_attachment() return access_control(request, rel_path).may_read_attachment()
def modify_attachment(request, rel_path): def modify_attachment(request, path):
# Interface for external module mycreole # Interface for external module mycreole
rel_path = os.path.dirname(path)
return access_control(request, rel_path).may_modify_attachment() return access_control(request, rel_path).may_modify_attachment()