瀏覽代碼

[search] Restrict edition to admin only

Romain Rigaux 11 年之前
父節點
當前提交
c583e9009b

+ 3 - 3
apps/search/src/search/api.py

@@ -237,10 +237,10 @@ class SolrApi(BaseSolrApi):
         f = []
         for _filter in fq['filter']:          
           if ' ' in _filter:
-            f.append(urllib.unquote(utf_quoter('%s:"%s"' % (fq['field'], _filter))))
+            f.append('%s:"%s"' % (fq['field'], _filter))
           else:
-            f.append(urllib.unquote(utf_quoter('{!field f=%s}%s' % (fq['field'], _filter))))
-        params += (('fq', '{!tag=%s}' % fq['field'] + ' '.join(f)),)
+            f.append('{!field f=%s}%s' % (fq['field'], _filter))
+        params += (('fq', urllib.unquote(utf_quoter('{!tag=%s}' % fq['field'] + ' '.join(f)))),)
       elif fq['type'] == 'range':
         params += (('fq', '{!tag=%s}' % fq['field'] + ' '.join([urllib.unquote(utf_quoter('%s:[%s TO %s}' % (fq['field'], f['from'], f['to']))) for f in fq['properties']])),)
 

+ 17 - 0
apps/search/src/search/decorators.py

@@ -16,12 +16,15 @@
 # limitations under the License.
 
 import logging
+import json
 
 from django.utils.functional import wraps
 from django.utils.translation import ugettext as _
 
 from desktop.lib.exceptions_renderable import PopupException
 
+from search.models import Collection
+
 LOG = logging.getLogger(__name__)
 
 
@@ -34,3 +37,17 @@ def allow_admin_only(view_func):
 
     return view_func(request, *args, **kwargs)
   return wraps(view_func)(decorate)
+
+
+def allow_writer_only(view_func):
+  def decorate(request, *args, **kwargs):
+
+    collection_json = json.loads(request.POST.get('collection', '{}'))
+    collection = Collection.objects.get(id=collection_json['id']) # TODO perms with doc model HUE-1987
+
+    if not request.user.is_superuser: 
+      message = _("Permission denied. You are not an Administrator.")
+      raise PopupException(message)
+
+    return view_func(request, *args, **kwargs)
+  return wraps(view_func)(decorate)

+ 9 - 7
apps/search/src/search/templates/search.mako

@@ -22,26 +22,28 @@ from django.utils.translation import ugettext as _
 ${ commonheader(_('Search'), "search", user, "80px") | n,unicode }
 
 <script type="text/javascript">
-  if (window.location.hash != ""){
-    if (window.location.hash.indexOf("collection") > -1){
+  if (window.location.hash != "") {
+    if (window.location.hash.indexOf("collection") > -1) {
       location.href = "/search/?" + window.location.hash.substr(1);
     }
   }
 </script>
 
 <div class="search-bar">
-  % if user.is_superuser:
-    <div class="pull-right" style="padding-right:50px">
+  <div class="pull-right" style="padding-right:50px">
+    % if user.is_superuser:
       <button type="button" title="${ _('Edit') }" rel="tooltip" data-placement="bottom" data-bind="click: toggleEditing, css: {'btn': true, 'btn-inverse': isEditing}"><i class="fa fa-pencil"></i></button>
       <button type="button" title="${ _('Save') }" rel="tooltip" data-placement="bottom" data-loading-text="${ _("Saving...") }" data-bind="click: save, css: {'btn': true}"><i class="fa fa-save"></i></button>
       <button type="button" title="${ _('Save') }" rel="tooltip" data-placement="bottom" data-bind="css: {'btn': true}"><i class="fa fa-cog"></i></button>
+    % endif
       <button type="button" title="${ _('Share') }" rel="tooltip" data-placement="bottom" data-bind="click: showShareModal, css: {'btn': true}"><i class="fa fa-link"></i></button>
+    % if user.is_superuser:
       ## for enable, live search, max number of downloads, change solr
       &nbsp;&nbsp;&nbsp;
       <a class="btn" href="${ url('search:new_search') }" title="${ _('New') }" rel="tooltip" data-placement="bottom" data-bind="css: {'btn': true}"><i class="fa fa-file-o"></i></a>
-      <a class="btn" href="${ url('search:admin_collections') }" title="${ _('Collections') }" rel="tooltip" data-placement="bottom" data-bind="css: {'btn': true}"><i class="fa fa-tags"></i></a> 
-    </div>
-  % endif
+      <a class="btn" href="${ url('search:admin_collections') }" title="${ _('Collections') }" rel="tooltip" data-placement="bottom" data-bind="css: {'btn': true}"><i class="fa fa-tags"></i></a>
+    % endif 
+  </div>  
   
   <form data-bind="visible: columns().length == 0">  
     ${ _('Search') }

+ 3 - 0
apps/search/src/search/tests.py

@@ -144,6 +144,9 @@ class TestWithMockedSolr(TestSearchBase):
         collection.fields_data(self.user)
     )
 
+  # TODO
+  # test facet with userlocation: türkiye, 東京, new york
+
   def test_download(self):
     collection, created = Collection.objects.get_or_create(name='collection_1', solr_properties={})
 

+ 8 - 18
apps/search/src/search/views.py

@@ -39,14 +39,9 @@ from django.utils.encoding import force_unicode
 from desktop.lib.rest.http_client import RestException
 
 
-
 LOG = logging.getLogger(__name__)
 
 
-def initial_collection(request, hue_collections):
-  return hue_collections[0].id
-
-
 def index(request):
   hue_collections = SearchController(request.user).get_search_collections()
   collection_id = request.GET.get('collection')
@@ -67,7 +62,7 @@ def index(request):
   })
 
 
-# TODO security
+@allow_admin_only
 def new_search(request):
   collections = SearchController(request.user).get_solr_collection().keys()
   if not collections:
@@ -92,7 +87,7 @@ def new_search(request):
   })
 
 
-# TODO security
+@allow_admin_only
 def browse(request, name):
   collections = SearchController(request.user).get_solr_collection().keys()
   if not collections:
@@ -120,7 +115,7 @@ def browse(request, name):
 def search(request):
   response = {}  
   
-  collection = json.loads(request.POST.get('collection', '{}')) # TODO decorator with doc model perms
+  collection = json.loads(request.POST.get('collection', '{}'))
   query = json.loads(request.POST.get('query', '{}'))
   # todo: remove the selected histo facet if multiq
 
@@ -149,10 +144,11 @@ def search(request):
   return HttpResponse(json.dumps(response), mimetype="application/json")
 
 
+@allow_admin_only
 def save(request):
   response = {'status': -1}  
   
-  collection = json.loads(request.POST.get('collection', '{}')) # TODO perms decorator
+  collection = json.loads(request.POST.get('collection', '{}')) # TODO perms
   layout = json.loads(request.POST.get('layout', '{}')) 
     
   if collection:
@@ -219,7 +215,6 @@ def admin_collections(request, is_redirect=False):
   })
 
 
-
 @allow_admin_only
 def admin_collections_import(request):
   if request.method == 'POST':
@@ -308,7 +303,6 @@ def admin_collection_copy(request):
   return HttpResponse(json.dumps(response), mimetype="application/json")
 
 
-# TODO security
 def query_suggest(request, collection_id, query=""):
   hue_collection = Collection.objects.get(id=collection_id)
   result = {'status': -1, 'message': 'Error'}
@@ -327,7 +321,6 @@ def query_suggest(request, collection_id, query=""):
   return HttpResponse(json.dumps(result), mimetype="application/json")
 
 
-# TODO security
 def index_fields_dynamic(request):  
   result = {'status': -1, 'message': 'Error'}
   
@@ -350,7 +343,6 @@ def index_fields_dynamic(request):
   return HttpResponse(json.dumps(result), mimetype="application/json")
 
 
-# TODO security
 def get_document(request):  
   result = {'status': -1, 'message': 'Error'}
 
@@ -372,7 +364,6 @@ def get_document(request):
   return HttpResponse(json.dumps(result), mimetype="application/json")
 
 
-# TODO security
 def get_timeline(request):  
   result = {'status': -1, 'message': 'Error'}
 
@@ -419,12 +410,11 @@ def get_timeline(request):
   return HttpResponse(json.dumps(result), mimetype="application/json")
 
 
-# TODO security
 def new_facet(request):  
   result = {'status': -1, 'message': 'Error'}
   
   try:
-    collection = json.loads(request.POST.get('collection', '{}'))
+    collection = json.loads(request.POST.get('collection', '{}')) # Perms
     
     facet_id = request.POST['id']
     facet_label = request.POST['label']
@@ -470,12 +460,12 @@ def new_facet(request):
 
   return HttpResponse(json.dumps(result), mimetype="application/json")
 
-# TODO security
+
 def get_range_facet(request):  
   result = {'status': -1, 'message': 'Error'}
 
   try:
-    collection = json.loads(request.POST.get('collection', '{}'))
+    collection = json.loads(request.POST.get('collection', '{}')) # Perms
     facet = json.loads(request.POST.get('facet', '{}'))
     action = request.POST.get('action', 'select')
             

+ 0 - 1
apps/search/static/js/search.ko.js

@@ -851,7 +851,6 @@ var SearchViewModel = function (collection_json, query_json, initial_json) {
   self.init = function (callback) {
 	self.initial.init();
 	self.collection.syncFields();
-    self.isEditing(true);
     self.search(callback);
   }