Changeset 2045

Timestamp:

06/18/09 09:40:36 (9 months ago)

Author:

JensDiemer

Message:

• limit update section to superusers only
• move page_admin.check_permissions into a generic decorator

Location:

branches/0.9/pylucid_project

Files:

• apps/pylucid/decorators.py (added)
• apps/pylucid/templates/admin/base_site.html (modified) (1 diff)
• apps/pylucid_update/urls.py (modified) (1 diff)
• apps/pylucid_update/views.py (modified) (7 diffs)
• pylucid_plugins/page_admin/views.py (modified) (2 diffs)

branches/0.9/pylucid_project/apps/pylucid/templates/admin/base_site.html

@@ -83 +83 @@
         <a href="#TODO">{% trans 'admin menu' %}</a>
     </li>
+    {% if user.is_superuser %}
     <li>
         <a href="{% url PyLucidUpdate-menu %}">{% trans 'update section' %}</a>
     </li>
+    {% endif %}
 </ul>
 {% endif %}

branches/0.9/pylucid_project/apps/pylucid_update/urls.py

@@ -8 +8 @@
 
 from pylucid_project.apps.pylucid_update import views
+from pylucid.decorators import superuser_only
 
 urlpatterns = patterns('',
-    url(r'^$',                      views.menu,                 name='PyLucidUpdate-menu'),
-    url(r'^update08/$',             views.update08,             name='PyLucidUpdate-update08'),
-    url(r'^update08templates/$',    views.update08templates,    name='PyLucidUpdate-update08templates'),
-    url(r'^update08styles/$',       views.update08styles,       name='PyLucidUpdate-update08styles'),
+    url(r'^$',
+        superuser_only(views.menu),
+        name='PyLucidUpdate-menu'
+    ),
+    url(r'^update08/$',
+        superuser_only(views.update08),
+        name='PyLucidUpdate-update08'
+    ),
+    url(r'^update08templates/$',
+        superuser_only(views.update08templates),
+        name='PyLucidUpdate-update08templates'
+    ),
+    url(r'^update08styles/$',
+        superuser_only(views.update08styles),
+        name='PyLucidUpdate-update08styles'
+    ),
 )

branches/0.9/pylucid_project/apps/pylucid_update/views.py

@@ -1 +1 @@
 # coding: utf-8
+
+"""
+    PyLucid update views
+    ~~~~~~~~~~~~~~~~~~~~
+
+    Last commit info:
+    ~~~~~~~~~~~~~~~~~
+    $LastChangedDate:$
+    $Rev:$
+    $Author: JensDiemer $
+
+    :copyleft: 2009 by the PyLucid team, see AUTHORS for more details.
+    :license: GNU GPL v3 or above, see LICENSE for more details.
+"""
 
 import posixpath
@@ -8 +22 @@
 from django.shortcuts import render_to_response
 from django.template.loader import find_template_source
-from django.contrib.auth.decorators import login_required
 
 from dbtemplates.models import Template
@@ -20 +33 @@
 
 
-@login_required
 def menu(request):
     """ Display a menu with all update view links """
@@ -27 +39 @@
     }
     return render_to_response('pylucid_update/menu.html', context, context_instance=RequestContext(request))
-
-
-
 
 
@@ -225 +234 @@
 
 
-@login_required
 def update08(request):
     """ Update PyLucid v0.8 model data to v0.9 models """
@@ -247 +255 @@
 
 
-@login_required
 def update08templates(request):
     title = "Update PyLucid v0.8 templates"
@@ -346 +353 @@
     
 
-@login_required
+
 def update08styles(request):
     title = "Update PyLucid v0.8 styles"

branches/0.9/pylucid_project/pylucid_plugins/page_admin/views.py

@@ -1 @@
-# coding:utf-8
+# coding: utf-8
 
-import warnings
+"""
+    PyLucid page admin
+    ~~~~~~~~~~~~~~~~~~
+
+    Last commit info:
+    ~~~~~~~~~~~~~~~~~
+    $LastChangedDate:$
+    $Rev:$
+    $Author: JensDiemer $
+
+    :copyleft: 2009 by the PyLucid team, see AUTHORS for more details.
+    :license: GNU GPL v3 or above, see LICENSE for more details.
+"""
 
 from django.conf import settings
 from django.template import RequestContext
 from django.utils.translation import ugettext as _
-from django.core.exceptions import PermissionDenied
 from django.http import HttpResponse, HttpResponseRedirect
 
 from pylucid.markup.converter import apply_markup
 from pylucid.shortcuts import render_pylucid_response
+from pylucid.decorators import check_permissions
 
 from page_admin.forms import EditPageForm
 
 
-EDIT_PERMISSIONS = (
+PAGE_EDIT_PERMISSIONS = (
     u'pylucid.change_pagecontent',
     u'pylucid.change_pagemeta'
-)
+) 
 
 
-def check_permissions(request, permissions):
-    """
-    TODO: Add a log entry, if user has not all permissions.
-    """
-    assert isinstance(permissions, (list, tuple))
-    user = request.user
-    
-    if not user.is_authenticated():
-        if settings.DEBUG: # Usefull??
-            warnings.warn("Anonymous can't edit page.")
-        raise PermissionDenied
-        
-    if not user.has_perms(permissions):
-        if settings.DEBUG: # Usefull??
-            msg = "User %r has not all permissions: %r (existing permissions: %r)" % (
-                user, permissions, user.get_all_permissions()
-            )
-            warnings.warn(msg)
-        raise PermissionDenied()
-    
-
-
-def _edit_page(request, form_url):
-    check_permissions(request, EDIT_PERMISSIONS)
-    
+def _edit_page(request, form_url):   
     pagemeta_instance = request.PYLUCID.pagemeta
     pagecontent_instance = request.PYLUCID.pagecontent
@@ -93 +81 @@
 
 
+@check_permissions(permissions=PAGE_EDIT_PERMISSIONS)
 def http_get_view(request):  
     action = request.GET["page_admin"]