浏览代码

HUE-4891 [useradmin] an unprivileged user can list document items

Prakash Ranade 9 年之前
父节点
当前提交
da45f7e
共有 2 个文件被更改,包括 13 次插入2 次删除
  1. 9 2
      desktop/core/src/desktop/api.py
  2. 4 0
      desktop/core/src/desktop/tests.py

+ 9 - 2
desktop/core/src/desktop/api.py

@@ -195,8 +195,15 @@ def get_document(request):
   doc_id = request.GET.get('id', '')
 
   if doc_id.isdigit():
-    doc = Document.objects.get(id=doc_id)
-    response = massage_doc_for_json(doc, request.user)
+    doc = None
+    try:
+      doc = Document.objects.get(id=doc_id)
+    except Document.DoesNotExist:
+      pass
+    if doc and doc.can_read(request.user):
+      response = massage_doc_for_json(doc, request.user)
+    else:
+      response['message'] = _('get_document requires read priviledge or document does not exist for: %s') % doc_id
   else:
     response['message'] = _('get_document requires an id integer parameter: %s') % doc_id
 

+ 4 - 0
desktop/core/src/desktop/tests.py

@@ -1034,6 +1034,10 @@ class TestDocument(object):
     finally:
       redaction.global_redaction_engine.policies = old_policies
 
+  def test_get_document(self):
+    c1 = make_logged_in_client(username='test_get_user', groupname='test_get_group', recreate=True, is_superuser=False)
+    r1 = c1.get('/desktop/api/doc/get?id=1')
+    assert_true(-1, json.loads(r1.content)['status'])
 
 def test_session_secure_cookie():
   with tempfile.NamedTemporaryFile() as cert_file: