Răsfoiți Sursa

HUE-2467 [sentry] Disallow admin operations on parent page of prefixed directories

Applying on the list of files the permissions instead of only whithin the
prefixed files. That way we blaclist the prefixes accordingly in their parent dir.
Romain Rigaux 11 ani în urmă
părinte
comite
20402cc

+ 20 - 5
apps/filebrowser/src/filebrowser/templates/listdir.mako

@@ -59,12 +59,24 @@ ${ fb_components.menubar() }
               isCurrentDirSelected().length == 0"><i class="fa fa-random"></i> ${_('Move')}</a></li>
               <li><a href="#" title="${_('Copy')}" data-bind="click: copy, enable: selectedFiles().length > 0 &&
               isCurrentDirSelected().length == 0"><i class="fa fa-files-o"></i> ${_('Copy')}</a></li>
-              <li><a href="#" title="${_('Download')}" data-bind="visible: !inTrash() && selectedFiles().length == 1 && selectedFile().type == 'file', click: downloadFile"><i class="fa fa-arrow-circle-o-down"></i> ${_('Download')}</a></li>
+              <li>
+                <a href="#" title="${_('Download')}" data-bind="visible: !inTrash() && selectedFiles().length == 1 && selectedFile().type == 'file', click: downloadFile">
+                  <i class="fa fa-arrow-circle-o-down"></i> ${_('Download')}
+                </a>
+              </li>
               <li class="divider"></li>
-              %if is_fs_superuser:
-              <li data-bind="css: {'disabled': isCurrentDirSentryManaged }"><a href="#" data-bind="visible: !inTrash(), click: changeOwner, enable: selectedFiles().length > 0"><i class="fa fa-user"></i> ${_('Change owner / group')}</a></li>
-              %endif
-              <li data-bind="css: {'disabled': isCurrentDirSentryManaged }"><a href="#" data-bind="visible: !inTrash(), click: changePermissions, enable: selectedFiles().length > 0"><i class="fa fa-list-alt"></i> ${_('Change permissions')}</a></li>
+              % if is_fs_superuser:
+              <li data-bind="css: {'disabled': isCurrentDirSentryManaged() || selectedSentryFiles().length > 0 }">
+                <a href="#" data-bind="visible: ! inTrash(), click: changeOwner, enable: selectedFiles().length > 0">
+                  <i class="fa fa-user"></i> ${_('Change owner / group')}
+                </a>
+              </li>
+              % endif
+              <li data-bind="css: {'disabled': isCurrentDirSentryManaged() || selectedSentryFiles().length > 0 }">
+                <a href="#" data-bind="visible: ! inTrash(), click: changePermissions, enable: selectedFiles().length > 0">
+                  <i class="fa fa-list-alt"></i> ${_('Change permissions')}
+                </a>
+              </li>
             </ul>
           </div>
           <button class="btn fileToolbarBtn" title="${_('Restore from trash')}" data-bind="visible: inRestorableTrash(), click: restoreTrashSelected, enable: selectedFiles().length > 0 && isCurrentDirSelected().length == 0"><i class="fa fa-cloud-upload"></i> ${_('Restore')}</button>
@@ -122,6 +134,9 @@ ${ fb_components.menubar() }
       <div class="alert alert-warn" data-bind="visible: isCurrentDirSentryManaged">
         ${ _('The permissions for this folder are managed by the Sentry Namenode plugin.') }
       </div>
+      <div class="alert alert-warn" data-bind="visible:selectedSentryFiles().length > 0">
+        ${ _('The permissions of some of the selected files are managed by the Sentry Namenode plugin.') }
+      </div>
 
       % if breadcrumbs:
         ${fb_components.breadcrumbs(path, breadcrumbs, True)}

+ 36 - 18
apps/filebrowser/src/filebrowser/templates/listdir_components.mako

@@ -417,10 +417,18 @@ from django.utils.translation import ugettext as _
     isCurrentDirSelected().length == 0"><i class="fa fa-files-o"></i> ${_('Copy')}</a></li>
     <li><a href="#" title="${_('Download')}" data-bind="visible: !$root.inTrash() && $root.selectedFiles().length == 1 && selectedFile().type == 'file', click: $root.downloadFile"><i class="fa fa-arrow-circle-o-down"></i> ${_('Download')}</a></li>
     <li class="divider"></li>
-    %if is_fs_superuser:
-    <li data-bind="css: {'disabled': $root.isCurrentDirSentryManaged }"><a href="#" data-bind="visible: !$root.inTrash(), click: $root.changeOwner, enable: $root.selectedFiles().length > 0"><i class="fa fa-user"></i> ${_('Change owner / group')}</a></li>
-    %endif
-    <li data-bind="css: {'disabled': $root.isCurrentDirSentryManaged }"><a href="#" data-bind="visible: !$root.inTrash(), click: $root.changePermissions, enable: $root.selectedFiles().length > 0"><i class="fa fa-list-alt"></i> ${_('Change permissions')}</a></li>
+    % if is_fs_superuser:
+    <li data-bind="css: {'disabled': $root.isCurrentDirSentryManaged || selectedSentryFiles().length > 0 }">
+      <a href="#" data-bind="visible: !$root.inTrash(), click: $root.changeOwner, enable: $root.selectedFiles().length > 0">
+        <i class="fa fa-user"></i> ${_('Change owner / group')}
+      </a>
+    </li>
+    % endif
+    <li data-bind="css: {'disabled': $root.isCurrentDirSentryManaged() || selectedSentryFiles().length > 0 }">
+      <a href="#" data-bind="visible: !$root.inTrash(), click: $root.changePermissions, enable: $root.selectedFiles().length > 0">
+        <i class="fa fa-list-alt"></i> ${_('Change permissions')}
+      </a>
+    </li>
     <li class="divider"></li>
     <li><a href="#"  data-bind="enable: $root.selectedFiles().length > 0 && isCurrentDirSelected().length == 0,
     click: $root.trashSelected"><i class="fa fa-times"></i> ${_('Move to trash')}</a></li>
@@ -464,24 +472,27 @@ from django.utils.translation import ugettext as _
         <span data-bind="visible: type == 'file', text: stats.size"></span>
       </td>
       <td>
-        %if is_fs_superuser:
-        <span data-bind="text: stats.user, visible: ! selected() || $root.isCurrentDirSentryManaged()"></span>
-        <a href="#" rel="tooltip" title="${_('Change owner')}" data-original-title="${_('Change owner')}" data-bind="text: stats.user, visible: ! $root.inTrash() && selected() && ! $root.isCurrentDirSentryManaged(), click: $root.changeOwner, enable: $root.selectedFiles().length > 0"></a>
-        %else:
+        % if is_fs_superuser:
+        <span data-bind="text: stats.user, visible: ! selected() || $root.isCurrentDirSentryManaged() || isSentryManaged"></span>
+        <a href="#" rel="tooltip" title="${_('Change owner')}" data-original-title="${_('Change owner')}"
+            data-bind="text: stats.user, visible: ! $root.inTrash() && selected() && ! $root.isCurrentDirSentryManaged() && ! isSentryManaged, click: $root.changeOwner, enable: $root.selectedFiles().length > 0"></a>
+        % else:
         <span data-bind="text: stats.user"></span>
-        %endif
+        % endif
       </td>
       <td>
-        %if is_fs_superuser:
-        <span data-bind="text: stats.group, visible: ! selected() || $root.isCurrentDirSentryManaged()"></span>
-        <a href="#" rel="tooltip" title="${_('Change group')}" data-original-title="${_('Change group')}" data-bind="text: stats.group, visible: ! $root.inTrash() && selected() && ! $root.isCurrentDirSentryManaged(), click: $root.changeOwner"></a>
-        %else:
+        % if is_fs_superuser:
+        <span data-bind="text: stats.group, visible: ! selected() || $root.isCurrentDirSentryManaged() || isSentryManaged"></span>
+        <a href="#" rel="tooltip" title="${_('Change group')}" data-original-title="${_('Change group')}"
+            data-bind="text: stats.group, visible: ! $root.inTrash() && selected() && ! $root.isCurrentDirSentryManaged() && ! isSentryManaged, click: $root.changeOwner"></a>
+        % else:
         <span data-bind="text: stats.group"></span>
-        %endif
+        % endif
       </td>
       <td>
-        <span data-bind="text: permissions, visible: ! selected() || $root.isCurrentDirSentryManaged()"></span>
-        <a href="#" rel="tooltip" title="${_('Change permissions')}" data-bind="text: permissions, visible: ! $root.inTrash() && selected() && ! $root.isCurrentDirSentryManaged(), click: $root.changePermissions" data-original-title="${_('Change permissions')}"></a>
+        <span data-bind="text: permissions, visible: ! selected() || $root.isCurrentDirSentryManaged() || isSentryManaged"></span>
+        <a href="#" rel="tooltip" title="${_('Change permissions')}"
+            data-bind="text: permissions, visible: ! $root.inTrash() && selected() && ! $root.isCurrentDirSentryManaged() && ! isSentryManaged, click: $root.changePermissions" data-original-title="${_('Change permissions')}"></a>
       </td>
       <td data-bind="text: stats.mtime" style="white-space: nowrap;"></td>
     </tr>
@@ -679,13 +690,14 @@ from django.utils.translation import ugettext as _
         type: file.type,
         permissions: file.rwx,
         mode: file.mode,
+        isSentryManaged: file.is_sentry_managed,
         stats: {
           size: file.humansize,
           user: file.stats.user,
           group: file.stats.group,
           mtime: file.mtime
         },
-        selected:ko.observable(false),
+        selected: ko.observable(false),
         handleSelect: function (row, e) {
           e.preventDefault();
           e.stopPropagation();
@@ -713,7 +725,7 @@ from django.utils.translation import ugettext as _
             cm.css({ display: 'none' });
           }
         },
-        hovered:ko.observable(false),
+        hovered: ko.observable(false),
         toggleHover: function (row, e) {
           this.hovered(! this.hovered());
         },
@@ -814,6 +826,12 @@ from django.utils.translation import ugettext as _
         });
       }, self);
 
+      self.selectedSentryFiles = ko.computed(function () {
+        return ko.utils.arrayFilter(self.files(), function (file) {
+          return file.selected() && file.isSentryManaged;
+        });
+      }, self);
+
       self.isCurrentDirSelected = ko.computed(function () {
         return ko.utils.arrayFilter(self.files(), function (file) {
           return file.name == "." && file.selected();

+ 2 - 1
apps/filebrowser/src/filebrowser/views.py

@@ -484,7 +484,8 @@ def _massage_stats(request, stats):
         'rwx': rwx(stats['mode'], stats['aclBit']),
         'mode': stringformat(stats['mode'], "o"),
         'url': make_absolute(request, "view", dict(path=urlquote(normalized))),
-        }
+        'is_sentry_managed': request.fs.is_sentry_managed(path)
+    }
 
 
 def stat(request, path):