matthias/mayan-edms
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Allow ObjectListPermissionFilterMixin to check access against a parent object and not just against the queryser of child objects.

Browse Source 
Signed-off-by: Roberto Rosario <roberto.rosario.gonzalez@gmail.com>
This commit is contained in:
Roberto Rosario
2018-04-06 01:13:10 -04:00
parent e35cde1f6c
commit b0c2d6cd76
1 changed files with 14 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
mayan/apps/common/mixins.py
View File

@@ -214,12 +214,25 @@ class ObjectActionMixin(object):
class ObjectListPermissionFilterMixin(object):
"""
access_object_retrieve_method is have the entire view check against
an object permission and not the individual secondary items.
"""
access_object_retrieve_method = None
object_permission = None
def dispatch(self, request, *args, **kwargs):
if self.access_object_retrieve_method and self.object_permission:
AccessControlList.objects.check_access(
permissions=(self.object_permission,), user=request.user,
obj=getattr(self, self.access_object_retrieve_method)()
)
return super(ObjectListPermissionFilterMixin, self).dispatch(request, *args, **kwargs)
def get_queryset(self):
queryset = super(ObjectListPermissionFilterMixin, self).get_queryset()
if self.object_permission:
if not self.get_document_type and self.object_permission:
return AccessControlList.objects.filter_by_access(
self.object_permission, self.request.user, queryset=queryset
)