From b0c2d6cd76289b49621ecd17db16b0c4cb217888 Mon Sep 17 00:00:00 2001 From: Roberto Rosario Date: Fri, 6 Apr 2018 01:13:10 -0400 Subject: [PATCH] Allow ObjectListPermissionFilterMixin to check access against a parent object and not just against the queryser of child objects. Signed-off-by: Roberto Rosario --- mayan/apps/common/mixins.py | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/mayan/apps/common/mixins.py b/mayan/apps/common/mixins.py index 307fa38089..e30ab10369 100644 --- a/mayan/apps/common/mixins.py +++ b/mayan/apps/common/mixins.py @@ -214,12 +214,25 @@ class ObjectActionMixin(object): class ObjectListPermissionFilterMixin(object): + """ + access_object_retrieve_method is have the entire view check against + an object permission and not the individual secondary items. + """ + access_object_retrieve_method = None object_permission = None + def dispatch(self, request, *args, **kwargs): + if self.access_object_retrieve_method and self.object_permission: + AccessControlList.objects.check_access( + permissions=(self.object_permission,), user=request.user, + obj=getattr(self, self.access_object_retrieve_method)() + ) + return super(ObjectListPermissionFilterMixin, self).dispatch(request, *args, **kwargs) + def get_queryset(self): queryset = super(ObjectListPermissionFilterMixin, self).get_queryset() - if self.object_permission: + if not self.get_document_type and self.object_permission: return AccessControlList.objects.filter_by_access( self.object_permission, self.request.user, queryset=queryset )