src/ldt/ldt/security/utils.py
author cavaliet
Fri, 13 Jan 2012 16:13:03 +0100
changeset 377 a1f9f7583925
parent 350 c6953232099f
child 482 c802e00c7131
permissions -rw-r--r--
The embed player can now play a youtube video.
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
239
352be36c9fd7 Moved code about group security into a separate module
verrierj
parents:
diff changeset
     1
from django.conf import settings
352be36c9fd7 Moved code about group security into a separate module
verrierj
parents:
diff changeset
     2
from django.contrib.contenttypes.models import ContentType
289
f78273a17bb3 Speed up response time when retrieving group projects
verrierj
parents: 285
diff changeset
     3
from guardian.shortcuts import assign, remove_perm, get_users_with_perms, get_groups_with_perms, get_objects_for_user
f78273a17bb3 Speed up response time when retrieving group projects
verrierj
parents: 285
diff changeset
     4
from cache import get_cached_userlist
350
c6953232099f Anonymous users can see pages even if they are not logged in + factor code to decrease number of SQL requests
verrierj
parents: 340
diff changeset
     5
from ldt.security import change_security 
340
5f919a978f50 Stats for annotations volume can be computed using ./manage.py statannotation [-c content_id] or in the admin pages of module ldt_utils.
verrierj
parents: 292
diff changeset
     6
import types
350
c6953232099f Anonymous users can see pages even if they are not logged in + factor code to decrease number of SQL requests
verrierj
parents: 340
diff changeset
     7
  
340
5f919a978f50 Stats for annotations volume can be computed using ./manage.py statannotation [-c content_id] or in the admin pages of module ldt_utils.
verrierj
parents: 292
diff changeset
     8
def unprotect_instance(instance):
5f919a978f50 Stats for annotations volume can be computed using ./manage.py statannotation [-c content_id] or in the admin pages of module ldt_utils.
verrierj
parents: 292
diff changeset
     9
    if hasattr(instance, 'old_save'):
5f919a978f50 Stats for annotations volume can be computed using ./manage.py statannotation [-c content_id] or in the admin pages of module ldt_utils.
verrierj
parents: 292
diff changeset
    10
        instance.save = instance.old_save
5f919a978f50 Stats for annotations volume can be computed using ./manage.py statannotation [-c content_id] or in the admin pages of module ldt_utils.
verrierj
parents: 292
diff changeset
    11
        instance.delete = instance.old_delete
5f919a978f50 Stats for annotations volume can be computed using ./manage.py statannotation [-c content_id] or in the admin pages of module ldt_utils.
verrierj
parents: 292
diff changeset
    12
        
5f919a978f50 Stats for annotations volume can be computed using ./manage.py statannotation [-c content_id] or in the admin pages of module ldt_utils.
verrierj
parents: 292
diff changeset
    13
def protect_instance(instance):
5f919a978f50 Stats for annotations volume can be computed using ./manage.py statannotation [-c content_id] or in the admin pages of module ldt_utils.
verrierj
parents: 292
diff changeset
    14
    class_name = instance.__class__.__name__.lower()
5f919a978f50 Stats for annotations volume can be computed using ./manage.py statannotation [-c content_id] or in the admin pages of module ldt_utils.
verrierj
parents: 292
diff changeset
    15
    cls = ContentType.objects.get(model=class_name)
5f919a978f50 Stats for annotations volume can be computed using ./manage.py statannotation [-c content_id] or in the admin pages of module ldt_utils.
verrierj
parents: 292
diff changeset
    16
    cls = cls.model_class()
5f919a978f50 Stats for annotations volume can be computed using ./manage.py statannotation [-c content_id] or in the admin pages of module ldt_utils.
verrierj
parents: 292
diff changeset
    17
    
5f919a978f50 Stats for annotations volume can be computed using ./manage.py statannotation [-c content_id] or in the admin pages of module ldt_utils.
verrierj
parents: 292
diff changeset
    18
    save = types.MethodType(change_security('project')(cls.save), instance, cls)
5f919a978f50 Stats for annotations volume can be computed using ./manage.py statannotation [-c content_id] or in the admin pages of module ldt_utils.
verrierj
parents: 292
diff changeset
    19
    instance.save = save
5f919a978f50 Stats for annotations volume can be computed using ./manage.py statannotation [-c content_id] or in the admin pages of module ldt_utils.
verrierj
parents: 292
diff changeset
    20
    
5f919a978f50 Stats for annotations volume can be computed using ./manage.py statannotation [-c content_id] or in the admin pages of module ldt_utils.
verrierj
parents: 292
diff changeset
    21
    delete = types.MethodType(change_security('project')(cls.delete), instance, cls)
5f919a978f50 Stats for annotations volume can be computed using ./manage.py statannotation [-c content_id] or in the admin pages of module ldt_utils.
verrierj
parents: 292
diff changeset
    22
    instance.delete = delete
5f919a978f50 Stats for annotations volume can be computed using ./manage.py statannotation [-c content_id] or in the admin pages of module ldt_utils.
verrierj
parents: 292
diff changeset
    23
        
239
352be36c9fd7 Moved code about group security into a separate module
verrierj
parents:
diff changeset
    24
245
953228fcbb56 Permissions are checked in search results
verrierj
parents: 242
diff changeset
    25
def set_forbidden_stream(xml, user):
953228fcbb56 Permissions are checked in search results
verrierj
parents: 242
diff changeset
    26
    cls = ContentType.objects.get(model='content')
953228fcbb56 Permissions are checked in search results
verrierj
parents: 242
diff changeset
    27
    cls = cls.model_class()
953228fcbb56 Permissions are checked in search results
verrierj
parents: 242
diff changeset
    28
    
953228fcbb56 Permissions are checked in search results
verrierj
parents: 242
diff changeset
    29
    old_user = cls.safe_objects.user
953228fcbb56 Permissions are checked in search results
verrierj
parents: 242
diff changeset
    30
    obj_list = cls.safe_objects.all()
953228fcbb56 Permissions are checked in search results
verrierj
parents: 242
diff changeset
    31
    
953228fcbb56 Permissions are checked in search results
verrierj
parents: 242
diff changeset
    32
    for elem in xml.xpath('/iri/medias/media'):
953228fcbb56 Permissions are checked in search results
verrierj
parents: 242
diff changeset
    33
        if not obj_list.filter(iri_id=elem.get('id')):
953228fcbb56 Permissions are checked in search results
verrierj
parents: 242
diff changeset
    34
            elem.set('video', settings.FORBIDDEN_STREAM_URL)
953228fcbb56 Permissions are checked in search results
verrierj
parents: 242
diff changeset
    35
    
953228fcbb56 Permissions are checked in search results
verrierj
parents: 242
diff changeset
    36
    cls.safe_objects.user = old_user 
953228fcbb56 Permissions are checked in search results
verrierj
parents: 242
diff changeset
    37
    
953228fcbb56 Permissions are checked in search results
verrierj
parents: 242
diff changeset
    38
    return xml
953228fcbb56 Permissions are checked in search results
verrierj
parents: 242
diff changeset
    39
251
81417fd477b0 Display specific tooltip when project edition is not allowed
verrierj
parents: 245
diff changeset
    40
def add_change_attr(user, obj_list):
274
80375a7b7e14 Improve permissions of medias + fix css
verrierj
parents: 273
diff changeset
    41
    """ 
80375a7b7e14 Improve permissions of medias + fix css
verrierj
parents: 273
diff changeset
    42
     Add a change attribute set to True to objects of obj_list
80375a7b7e14 Improve permissions of medias + fix css
verrierj
parents: 273
diff changeset
    43
     if permissions change_object is set with respect to user.
80375a7b7e14 Improve permissions of medias + fix css
verrierj
parents: 273
diff changeset
    44
    """
251
81417fd477b0 Display specific tooltip when project edition is not allowed
verrierj
parents: 245
diff changeset
    45
    if len(obj_list) == 0:
81417fd477b0 Display specific tooltip when project edition is not allowed
verrierj
parents: 245
diff changeset
    46
        return []
81417fd477b0 Display specific tooltip when project edition is not allowed
verrierj
parents: 245
diff changeset
    47
    
81417fd477b0 Display specific tooltip when project edition is not allowed
verrierj
parents: 245
diff changeset
    48
    model_name = obj_list[0].__class__.__name__.lower()
81417fd477b0 Display specific tooltip when project edition is not allowed
verrierj
parents: 245
diff changeset
    49
    ctype = ContentType.objects.get(model=model_name)
81417fd477b0 Display specific tooltip when project edition is not allowed
verrierj
parents: 245
diff changeset
    50
    cls = ctype.model_class()
289
f78273a17bb3 Speed up response time when retrieving group projects
verrierj
parents: 285
diff changeset
    51
290
e1980a7d4b83 Fix bug when checking for add_group permission
verrierj
parents: 289
diff changeset
    52
    if model_name in [cls_name.lower() for cls_name in settings.USE_GROUP_PERMISSIONS] or model_name == 'group':
289
f78273a17bb3 Speed up response time when retrieving group projects
verrierj
parents: 285
diff changeset
    53
        to_check = True
f78273a17bb3 Speed up response time when retrieving group projects
verrierj
parents: 285
diff changeset
    54
        change_list = get_objects_for_user(user, '%s.change_%s' % (cls._meta.app_label, model_name))
274
80375a7b7e14 Improve permissions of medias + fix css
verrierj
parents: 273
diff changeset
    55
    else:
289
f78273a17bb3 Speed up response time when retrieving group projects
verrierj
parents: 285
diff changeset
    56
        to_check = False        
251
81417fd477b0 Display specific tooltip when project edition is not allowed
verrierj
parents: 245
diff changeset
    57
        
81417fd477b0 Display specific tooltip when project edition is not allowed
verrierj
parents: 245
diff changeset
    58
    for obj in obj_list:
289
f78273a17bb3 Speed up response time when retrieving group projects
verrierj
parents: 285
diff changeset
    59
        if not to_check or obj in change_list:
251
81417fd477b0 Display specific tooltip when project edition is not allowed
verrierj
parents: 245
diff changeset
    60
            obj.change = True
81417fd477b0 Display specific tooltip when project edition is not allowed
verrierj
parents: 245
diff changeset
    61
        else:
81417fd477b0 Display specific tooltip when project edition is not allowed
verrierj
parents: 245
diff changeset
    62
            obj.change = False
81417fd477b0 Display specific tooltip when project edition is not allowed
verrierj
parents: 245
diff changeset
    63
            
274
80375a7b7e14 Improve permissions of medias + fix css
verrierj
parents: 273
diff changeset
    64
    return obj_list
269
4b8042fc3d33 Moved Share to form to security module
verrierj
parents: 268
diff changeset
    65
4b8042fc3d33 Moved Share to form to security module
verrierj
parents: 268
diff changeset
    66
def assign_perm_to_obj(object, read_list, write_list, owner):
260
3d9cb9b6ff8d Add permission form to content
verrierj
parents: 251
diff changeset
    67
    name = object.__class__.__name__.lower()
268
c0c161736794 Projects can be shared with users and groups. Does not work with contents yet, still some bugs in templates
verrierj
parents: 265
diff changeset
    68
    
c0c161736794 Projects can be shared with users and groups. Does not work with contents yet, still some bugs in templates
verrierj
parents: 265
diff changeset
    69
    old_users = get_users_with_perms(object).exclude(id=owner.id)
c0c161736794 Projects can be shared with users and groups. Does not work with contents yet, still some bugs in templates
verrierj
parents: 265
diff changeset
    70
    old_groups = get_groups_with_perms(object)
c0c161736794 Projects can be shared with users and groups. Does not work with contents yet, still some bugs in templates
verrierj
parents: 265
diff changeset
    71
    
c0c161736794 Projects can be shared with users and groups. Does not work with contents yet, still some bugs in templates
verrierj
parents: 265
diff changeset
    72
    for elem in read_list:
c0c161736794 Projects can be shared with users and groups. Does not work with contents yet, still some bugs in templates
verrierj
parents: 265
diff changeset
    73
        assign('view_%s' % name, elem, object)
c0c161736794 Projects can be shared with users and groups. Does not work with contents yet, still some bugs in templates
verrierj
parents: 265
diff changeset
    74
        if elem in write_list:
c0c161736794 Projects can be shared with users and groups. Does not work with contents yet, still some bugs in templates
verrierj
parents: 265
diff changeset
    75
            assign('change_%s' % name, elem, object)
239
352be36c9fd7 Moved code about group security into a separate module
verrierj
parents:
diff changeset
    76
        else:
268
c0c161736794 Projects can be shared with users and groups. Does not work with contents yet, still some bugs in templates
verrierj
parents: 265
diff changeset
    77
            remove_perm('change_%s' % name, elem, object)            
c0c161736794 Projects can be shared with users and groups. Does not work with contents yet, still some bugs in templates
verrierj
parents: 265
diff changeset
    78
                
c0c161736794 Projects can be shared with users and groups. Does not work with contents yet, still some bugs in templates
verrierj
parents: 265
diff changeset
    79
    def remove_perms(new_list, old_list, obj, name):
c0c161736794 Projects can be shared with users and groups. Does not work with contents yet, still some bugs in templates
verrierj
parents: 265
diff changeset
    80
        for e in old_list:
c0c161736794 Projects can be shared with users and groups. Does not work with contents yet, still some bugs in templates
verrierj
parents: 265
diff changeset
    81
            if e not in new_list:
c0c161736794 Projects can be shared with users and groups. Does not work with contents yet, still some bugs in templates
verrierj
parents: 265
diff changeset
    82
                remove_perm('view_%s' % name, e, obj)
c0c161736794 Projects can be shared with users and groups. Does not work with contents yet, still some bugs in templates
verrierj
parents: 265
diff changeset
    83
                remove_perm('change_%s' % name, e, obj)
c0c161736794 Projects can be shared with users and groups. Does not work with contents yet, still some bugs in templates
verrierj
parents: 265
diff changeset
    84
                
c0c161736794 Projects can be shared with users and groups. Does not work with contents yet, still some bugs in templates
verrierj
parents: 265
diff changeset
    85
    remove_perms(read_list, old_users, object, name)
274
80375a7b7e14 Improve permissions of medias + fix css
verrierj
parents: 273
diff changeset
    86
    remove_perms(read_list, old_groups, object, name) 
269
4b8042fc3d33 Moved Share to form to security module
verrierj
parents: 268
diff changeset
    87
    
281
832c5049b358 Factor code to display userlist in project/content edition
verrierj
parents: 279
diff changeset
    88
def get_userlist(user, filter=None):
282
7512c33b64be Add cache to userlist
verrierj
parents: 281
diff changeset
    89
    user_list = get_cached_userlist().exclude(id=user.id)
281
832c5049b358 Factor code to display userlist in project/content edition
verrierj
parents: 279
diff changeset
    90
    if filter:
832c5049b358 Factor code to display userlist in project/content edition
verrierj
parents: 279
diff changeset
    91
        user_list = user_list.filter(username__icontains=filter)
832c5049b358 Factor code to display userlist in project/content edition
verrierj
parents: 279
diff changeset
    92
    elem_list = [{'name': u.username, 'id': u.id, 'type': 'user'} for u in user_list[0:settings.MAX_USERS_SEARCH]]
832c5049b358 Factor code to display userlist in project/content edition
verrierj
parents: 279
diff changeset
    93
    return elem_list  
832c5049b358 Factor code to display userlist in project/content edition
verrierj
parents: 279
diff changeset
    94
273
23a756e0bfee Fix bug in group form
verrierj
parents: 269
diff changeset
    95
def get_userlist_model(object, owner):
275
a14509d74e13 Change modal window size + improve get_urserlist_model function for public contents
verrierj
parents: 274
diff changeset
    96
    if hasattr(object, 'is_public') and object.is_public:
a14509d74e13 Change modal window size + improve get_urserlist_model function for public contents
verrierj
parents: 274
diff changeset
    97
        return [None, None]
a14509d74e13 Change modal window size + improve get_urserlist_model function for public contents
verrierj
parents: 274
diff changeset
    98
    
285
1cc364d7b298 Fix bug in project copy from group tab
verrierj
parents: 282
diff changeset
    99
    users = get_users_with_perms(object, attach_perms=True, with_group_users=False)
273
23a756e0bfee Fix bug in group form
verrierj
parents: 269
diff changeset
   100
    groups = get_groups_with_perms(object, attach_perms=True)
23a756e0bfee Fix bug in group form
verrierj
parents: 269
diff changeset
   101
    object_name = object.__class__.__name__.lower()
263
eba92ea32281 Ask confirmation when user leaves a group
verrierj
parents: 260
diff changeset
   102
    
273
23a756e0bfee Fix bug in group form
verrierj
parents: 269
diff changeset
   103
    def create_dict (users_or_groups, name, groups=True):
23a756e0bfee Fix bug in group form
verrierj
parents: 269
diff changeset
   104
        l = []
23a756e0bfee Fix bug in group form
verrierj
parents: 269
diff changeset
   105
        admin_list = []
23a756e0bfee Fix bug in group form
verrierj
parents: 269
diff changeset
   106
        
23a756e0bfee Fix bug in group form
verrierj
parents: 269
diff changeset
   107
        for elem in users_or_groups.keys():
23a756e0bfee Fix bug in group form
verrierj
parents: 269
diff changeset
   108
            if elem == owner:
23a756e0bfee Fix bug in group form
verrierj
parents: 269
diff changeset
   109
                continue
23a756e0bfee Fix bug in group form
verrierj
parents: 269
diff changeset
   110
                        
23a756e0bfee Fix bug in group form
verrierj
parents: 269
diff changeset
   111
            if groups:
23a756e0bfee Fix bug in group form
verrierj
parents: 269
diff changeset
   112
                elem_dict = {'name': elem.name, 'type': 'group', 'id': elem.id}
23a756e0bfee Fix bug in group form
verrierj
parents: 269
diff changeset
   113
            else:
23a756e0bfee Fix bug in group form
verrierj
parents: 269
diff changeset
   114
                elem_dict = {'name': elem.username, 'type': 'user', 'id': elem.id}
23a756e0bfee Fix bug in group form
verrierj
parents: 269
diff changeset
   115
            
23a756e0bfee Fix bug in group form
verrierj
parents: 269
diff changeset
   116
            for perm in users_or_groups[elem]:
23a756e0bfee Fix bug in group form
verrierj
parents: 269
diff changeset
   117
                if perm == 'change_%s' % name:
23a756e0bfee Fix bug in group form
verrierj
parents: 269
diff changeset
   118
                    elem_dict['change'] = True
23a756e0bfee Fix bug in group form
verrierj
parents: 269
diff changeset
   119
                    admin_list.append(elem_dict)
23a756e0bfee Fix bug in group form
verrierj
parents: 269
diff changeset
   120
                    continue
23a756e0bfee Fix bug in group form
verrierj
parents: 269
diff changeset
   121
                
23a756e0bfee Fix bug in group form
verrierj
parents: 269
diff changeset
   122
            l.append(elem_dict)   
23a756e0bfee Fix bug in group form
verrierj
parents: 269
diff changeset
   123
        return l, admin_list
23a756e0bfee Fix bug in group form
verrierj
parents: 269
diff changeset
   124
    
23a756e0bfee Fix bug in group form
verrierj
parents: 269
diff changeset
   125
    users_list, admin_users = create_dict(users, object_name, False)
23a756e0bfee Fix bug in group form
verrierj
parents: 269
diff changeset
   126
    groups_list, admin_groups = create_dict(groups, object_name, True)
23a756e0bfee Fix bug in group form
verrierj
parents: 269
diff changeset
   127
    
23a756e0bfee Fix bug in group form
verrierj
parents: 269
diff changeset
   128
    return [users_list + groups_list, admin_users + admin_groups]
285
1cc364d7b298 Fix bug in project copy from group tab
verrierj
parents: 282
diff changeset
   129
 
273
23a756e0bfee Fix bug in group form
verrierj
parents: 269
diff changeset
   130
def get_userlist_group(group, user):
23a756e0bfee Fix bug in group form
verrierj
parents: 269
diff changeset
   131
    members = group.user_set.all()
23a756e0bfee Fix bug in group form
verrierj
parents: 269
diff changeset
   132
    admin = get_users_with_perms(group)
23a756e0bfee Fix bug in group form
verrierj
parents: 269
diff changeset
   133
269
4b8042fc3d33 Moved Share to form to security module
verrierj
parents: 268
diff changeset
   134
    member_list = []
273
23a756e0bfee Fix bug in group form
verrierj
parents: 269
diff changeset
   135
    for u in members:
23a756e0bfee Fix bug in group form
verrierj
parents: 269
diff changeset
   136
        if u == user:
23a756e0bfee Fix bug in group form
verrierj
parents: 269
diff changeset
   137
            continue
278
d16ec14aaf29 Add methods to set user in current thread
verrierj
parents: 275
diff changeset
   138
        u_dict = {'name': u.username, 'id': u.id, 'type': 'user', 'change': False}
273
23a756e0bfee Fix bug in group form
verrierj
parents: 269
diff changeset
   139
        if u in admin:
23a756e0bfee Fix bug in group form
verrierj
parents: 269
diff changeset
   140
            u_dict['change'] = True
23a756e0bfee Fix bug in group form
verrierj
parents: 269
diff changeset
   141
        member_list.append(u_dict)
269
4b8042fc3d33 Moved Share to form to security module
verrierj
parents: 268
diff changeset
   142
        
278
d16ec14aaf29 Add methods to set user in current thread
verrierj
parents: 275
diff changeset
   143
    admin_list = [{'name': e.username, 'id': e.id, 'type': 'user', 'change': False} for e in admin]
269
4b8042fc3d33 Moved Share to form to security module
verrierj
parents: 268
diff changeset
   144
    
273
23a756e0bfee Fix bug in group form
verrierj
parents: 269
diff changeset
   145
    return [member_list, admin_list]