src/cm/security.py
changeset 449 5387c032df35
parent 355 c926868cf7e6
child 470 077be006891e
equal deleted inserted replaced
448:054d572a3db4 449:5387c032df35
    11 import logging
    11 import logging
    12 
    12 
    13 from cm.models import *
    13 from cm.models import *
    14 from cm import cm_settings
    14 from cm import cm_settings
    15 from cm.exception import UnauthorizedException
    15 from cm.exception import UnauthorizedException
       
    16 from cm.cm_settings import DECORATED_CREATORS
    16 
    17 
    17 def get_request_user(request):
    18 def get_request_user(request):
    18     if request and request.user and not request.user.is_anonymous():
    19     if request and request.user and not request.user.is_anonymous():
    19         user = request.user
    20         user = request.user
    20     else:
    21     else:
    97        comment.comment_set.count() != 0 and \
    98        comment.comment_set.count() != 0 and \
    98        not has_perm(request, 'can_manage_text', text=text):
    99        not has_perm(request, 'can_manage_text', text=text):
    99         return False
   100         return False
   100     
   101     
   101     actual_own_user = False
   102     actual_own_user = False
   102     from cm.cm_settings import DECORATED_CREATORS
       
   103     if comment.user == request.user:
   103     if comment.user == request.user:
   104       if DECORATED_CREATORS:
   104       if DECORATED_CREATORS:
   105         if request.GET.get('name', None) == comment.get_name():
   105         if request.GET.get('name', None) == comment.get_name():
   106           actual_own_user = True
   106           actual_own_user = True
   107       else:
   107       else:
   155     user = get_request_user(request)
   155     user = get_request_user(request)
   156         
   156         
   157     if user and has_perm(request, 'can_view_unapproved_comment', text=text):
   157     if user and has_perm(request, 'can_view_unapproved_comment', text=text):
   158         return list(comments.order_by(*order_by))
   158         return list(comments.order_by(*order_by))
   159     else:
   159     else:
       
   160         # Fetch role_model to process specific behaviour for role_teacher model
       
   161         from cm.models import ApplicationConfiguration
       
   162         role_model = ApplicationConfiguration.get_key('workspace_role_model')
       
   163 
   160         if has_perm(request, 'can_view_approved_comment', text=text):
   164         if has_perm(request, 'can_view_approved_comment', text=text):
   161             visible_comments = comments.filter(state = 'approved').order_by(*order_by)
   165             visible_comments = comments.filter(state = 'approved').order_by(*order_by)
   162             # filter comments with a non visible (i.e. moderated) comment in the above thread 
   166             # filter comments with a non visible (i.e. moderated) comment in the above thread 
   163             comments_thread_viewable = [c for c in visible_comments if c.is_thread_full_visible()]
   167             comments_thread_viewable = [c for c in visible_comments if c.is_thread_full_visible()]
       
   168 
       
   169             # for role_teacher role model, do not show 'individual student' comments
       
   170             if (role_model == 'teacher'):
       
   171               unfiltered_comments = list(comments_thread_viewable)
       
   172               for c in unfiltered_comments:
       
   173                 if c.user_id and c.user_id != 1:
       
   174                   try:
       
   175                     userrole = UserRole.objects.get(user=c.user, text=text)
       
   176                   except:
       
   177                     userrole = UserRole.objects.get(user=None, text=None)
       
   178                   if userrole.role_id == None:
       
   179                     role = c.user.get_profile().global_userrole().role
       
   180                   else:
       
   181                     role = userrole.role
       
   182                   if role.name == 'Individual student':
       
   183                     comments_thread_viewable.remove(c)
   164             return comments_thread_viewable 
   184             return comments_thread_viewable 
   165         elif user and has_perm(request, 'can_view_comment_own', text=text):
   185         elif user and has_perm(request, 'can_view_comment_own', text=text):
   166             visible_comments = comments.filter(user=user).order_by(*order_by)
   186             if DECORATED_CREATORS:
       
   187               visible_comments = comments.filter(name=request.GET.get('name', None)).order_by(*order_by)
       
   188             else:
       
   189               visible_comments = comments.filter(user=user).order_by(*order_by)
       
   190 
       
   191             # for role_teacher role model, add 'teacher' comments
       
   192             if (role_model == 'teacher'):
       
   193               with_teachers = []
       
   194               for u in list(User.objects.filter(userrole__role__name = 'Teacher')):
       
   195                 if DECORATED_CREATORS:
       
   196                   with_teachers.append(u.username)
       
   197                 else:
       
   198                   with_teachers.append(u.id)
       
   199 
       
   200               # add admin and current user
       
   201               admin =  User.objects.get(id=1)
       
   202               if DECORATED_CREATORS:
       
   203                 with_teachers.append(admin.username)
       
   204                 with_teachers.append(request.GET.get('name', None))
       
   205                 visible_comments = comments.filter(name__in=with_teachers).order_by(*order_by)
       
   206               else:
       
   207                 with_teachers.append(admin.id)
       
   208                 with_teachers.append(user.id)
       
   209                 visible_comments = comments.filter(user__id__in=with_teachers).order_by(*order_by)
       
   210 
   167             # filter comments with a non visible (i.e. moderated) comment in the above thread 
   211             # filter comments with a non visible (i.e. moderated) comment in the above thread 
   168             comments_thread_viewable = [c for c in visible_comments if c.is_thread_full_visible(own_user=user)]
   212             comments_thread_viewable = [c for c in visible_comments if c.is_thread_full_visible(own_user=user)]
   169             return comments_thread_viewable                
   213             return comments_thread_viewable                
   170         else:
   214         else:
   171             return []
   215             return []