Pārlūkot izejas kodu

HUE-2857 [search] Only allow admin to edit the index for now

We can revisit with the Sentry integration
Romain Rigaux 10 gadi atpakaļ
vecāks
revīzija
ce2866a

+ 4 - 1
apps/search/src/search/search_controller.py

@@ -17,7 +17,6 @@
 # limitations under the License.
 
 import logging
-import uuid
 
 from django.db.models import Q
 
@@ -132,3 +131,7 @@ class SearchController(object):
       return indexes + SolrApi(SOLR_URL.get(), self.user).cores().keys()
     else:
       return indexes
+
+
+def can_edit_index(user):
+  return user.is_superuser

+ 1 - 1
apps/search/src/search/templates/search.mako

@@ -765,7 +765,7 @@ ${ dashboard.layout_skeleton() }
     <!--[if IE]><img src="${ static('desktop/art/spinner.gif') }" /><![endif]-->
   <!-- /ko -->
   <!-- ko if: $data.details().length > 0 -->
-    <div class="document-details-actions pull-left">
+    <div class="document-details-actions pull-left" data-bind="visible: ${ 'true' if can_edit_index else 'false' } || externalLink()">
       <a href="javascript:void(0)" data-bind="visible: ! showEdit(), click: function() { showEdit(true); }" title="${ _('Edit this document') }">
         <i class="fa fa-edit fa-fw"></i>
       </a>

+ 22 - 0
apps/search/src/search/tests.py

@@ -90,6 +90,28 @@ class TestWithMockedSolr(TestSearchBase):
     response = self.c.get(reverse('search:index'))
     assert_true('search' in response.content, response.content)
 
+  def test_update_document(self):
+    # Regular user
+    response = self.c.post(reverse('search:update_document'), {
+        'collection': json.dumps(self._get_collection_param(self.collection)),
+        'document': json.dumps({'hasChanged': False})
+    })
+
+    data = json.loads(response.content)
+    assert_equal(-1, data['status'], response.content)
+    assert_true('denied' in data['message'], response.content)
+
+    # Admin
+    c = make_logged_in_client(username='admin', is_superuser=True)
+    response = c.post(reverse('search:update_document'), {
+        'collection': json.dumps(self._get_collection_param(self.collection)),
+        'document': json.dumps({'hasChanged': False})
+    })
+
+    data = json.loads(response.content)
+    assert_equal(0, data['status'], response.content)
+    assert_true('no modifications to change' in data['message'], response.content)
+
   def test_strip_nulls(self):
     response = '{"uid":"1111111","method":"check_user"}\x00'
     response = json.loads(response.replace('\x00', '')) # Does not call real API

+ 15 - 5
apps/search/src/search/views.py

@@ -36,7 +36,7 @@ from search.data_export import download as export_download
 from search.decorators import allow_owner_only, allow_viewer_only
 from search.management.commands import search_setup
 from search.models import Collection2, augment_solr_response, augment_solr_exception, pairwise2
-from search.search_controller import SearchController
+from search.search_controller import SearchController, can_edit_index
 
 
 LOG = logging.getLogger(__name__)
@@ -63,7 +63,8 @@ def index(request):
     'collection': collection,
     'query': query,
     'initial': json.dumps({'collections': [], 'layout': [], 'is_latest': LATEST.get()}),
-    'is_owner': collection_doc.doc.get().can_write(request.user)
+    'is_owner': collection_doc.doc.get().can_write(request.user),
+    'can_edit_index': can_edit_index(request.user)
   })
 
 
@@ -90,9 +91,10 @@ def new_search(request):
                    "properties":{},"offset":0,"isLoading":True,"klass":"card card-widget span12"}]}],
                  "drops":["temp"],"klass":"card card-home card-column span10"},
          ],
-         'is_latest': LATEST.get()
+         'is_latest': LATEST.get(),
      }),
-    'is_owner': True
+    'is_owner': True,
+    'can_edit_index': can_edit_index(request.user)
   })
 
 
@@ -118,7 +120,8 @@ def browse(request, name):
          ],
          'is_latest': LATEST.get()
      }),
-     'is_owner': True
+     'is_owner': True,
+     'can_edit_index': can_edit_index(request.user)
   })
 
 
@@ -321,6 +324,10 @@ def get_document(request):
 def update_document(request):
   result = {'status': -1, 'message': 'Error'}
 
+  if not can_edit_index(request.user):
+    result['message'] = _('Permission to edit the document denied')
+    return JsonResponse(result)
+
   try:
     collection = json.loads(request.POST.get('collection', '{}'))
     document = json.loads(request.POST.get('document', '{}'))
@@ -341,6 +348,9 @@ def update_document(request):
       if SolrApi(SOLR_URL.get(), request.user).update(collection['name'], json.dumps([edits]), content_type='json', version=version):
         result['status'] = 0
         result['message'] = _('Document successfully updated.')
+    else:
+      result['status'] = 0
+      result['message'] = _('Document has no modifications to change.')
 
   except Exception, e:
     result['message'] = force_unicode(e)