浏览代码

HUE-4278 [useradmin] Restrict access to useradmin API to superusers

Jenny Kim 9 年之前
父节点
当前提交
3057fd9
共有 2 个文件被更改,包括 10 次插入2 次删除
  1. 2 0
      apps/useradmin/src/useradmin/api.py
  2. 8 2
      desktop/core/src/desktop/decorators.py

+ 2 - 0
apps/useradmin/src/useradmin/api.py

@@ -19,6 +19,7 @@ import logging
 
 from django.contrib.auth.models import User, Group
 
+from desktop.decorators import check_superuser_permission
 from desktop.lib.django_util import JsonResponse
 from desktop.lib.i18n import smart_unicode
 
@@ -40,6 +41,7 @@ def error_handler(view_fn):
 
 
 @error_handler
+@check_superuser_permission
 def get_users(request):
   """
   Returns all users with username, ID, groups, active and superuser status by default.

+ 8 - 2
desktop/core/src/desktop/decorators.py

@@ -17,11 +17,9 @@
 
 import logging
 
-from django.utils.functional import wraps
 from django.utils.translation import ugettext as _
 
 from desktop.lib.exceptions_renderable import PopupException
-
 from desktop.models import Document2
 
 
@@ -51,6 +49,14 @@ def hue_permission_required(action, app):
   return decorator
 
 
+def check_superuser_permission(view_func):
+  def decorate(request, *args, **kwargs):
+    if not request.user.is_superuser:
+      raise PopupException(_('You must be a superuser to perform this operation.'), error_code=401)
+    return view_func(request, *args, **kwargs)
+  return wraps(view_func)(decorate)
+
+
 def check_document_access_permission():
   def inner(view_func):
     def decorate(request, *args, **kwargs):