ソースを参照

[desktop] Polish permissions based on URL

Because of some special URL formats, some urls trigger a missing permission.
Romain Rigaux 12 年 前
コミット
2b3f8c5a02

+ 1 - 1
apps/useradmin/src/useradmin/models.py

@@ -104,7 +104,7 @@ class UserProfile(models.Model):
       try:
         perm = self._lookup_permission(app, action)
       except HuePermission.DoesNotExist:
-        LOG.exception("Permission object not available. Was syncdb run after installation?")
+        LOG.exception("Permission object %s - %s not available. Was syncdb run after installation?" % (app, action))
         return self.user.is_superuser
     if self.user.is_superuser:
       return True

+ 2 - 2
desktop/core/src/desktop/middleware.py

@@ -316,11 +316,11 @@ class LoginAndPermissionMiddleware(object):
       # Here we trust the URL to be the real app we need to check the perms.
       app_accessed = request._desktop_app
       ui_app_accessed = get_app_name(request)
-      if app_accessed != ui_app_accessed:
+      if app_accessed != ui_app_accessed and ui_app_accessed not in ('logs', 'dump_config', 'debug'):
         app_accessed = ui_app_accessed
 
       if app_accessed and \
-          app_accessed not in ("desktop", "home") and \
+          app_accessed not in ("desktop", "home", "about") and \
           not (request.user.has_hue_permission(action="access", app=app_accessed) or
                request.user.has_hue_permission(action=access_view, app=app_accessed)):
         access_log(request, 'permission denied', level=access_log_level)

+ 1 - 1
desktop/core/src/desktop/tests.py

@@ -198,7 +198,7 @@ def test_dump_config():
   grant_access("not_me", "test", "desktop")
 
   response = client_not_me.get('/dump_config')
-  assert_true("You do not have permission" in response.content, response.content)
+  assert_true("You must be a superuser" in response.content, response.content)
 
   os.environ["HUE_CONF_DIR"] = "/tmp/test_hue_conf_dir"
   resp = c.get('/dump_config')