DAV-KA/django-dav-events
1
0
Fork 0
Code Issues 24 Pull Requests Actions Releases Wiki Activity

Improved authorization.

Browse Source
This commit is contained in:
heinzel
2018-01-29 17:53:29 +01:00
parent b68949ba5f
commit fdcc103571
2 changed files with 27 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

27
dav_events/views/events.py
View File

@@ -31,12 +31,20 @@ class EventListView(generic.ListView):
elif has_role(user, 'manage_all'):
qs = self.model.objects.all()
else:
filter = Q(owner=user)
user_sports_list = list()
for k in ('W', 'S', 'M', 'K', 'B'):
role = 'manage_{}'.format(k.lower())
if has_role(user, role):
user_sports_list.append(k)
qs = self.model.objects.filter(Q(owner=user) | Q(sport__in=user_sports_list))
filter |= Q(sport__in=user_sports_list)
if has_role(user, 'publish') or has_role(user, 'publish_incremental'):
filter |= Q(accepted=True)
qs = self.model.objects.filter(filter)
return qs
@@ -110,10 +118,21 @@ class EventPermissionMixin(object):
return True
if has_role(user, 'manage_{}'.format(obj.sport.lower())):
return True
elif permission in ('update', 'accept'):
if has_role(user, 'manage_all'):
if obj.accepted and (has_role(user, 'publish') or has_role(user, 'publish_incremental')):
return True
if has_role(user, 'manage_{}'.format(obj.sport.lower())):
elif permission == 'accept':
if not obj.accepted:
if has_role(user, 'manage_all'):
return True
if has_role(user, 'manage_{}'.format(obj.sport.lower())):
return True
elif permission == 'update':
if not obj.accepted:
if has_role(user, 'manage_all'):
return True
if has_role(user, 'manage_{}'.format(obj.sport.lower())):
return True
elif has_role(user, 'publish') or has_role(user, 'publish_incremental'):
return True
return False