author | Sylvain Thénault <sylvain.thenault@logilab.fr> |
Thu, 30 Jul 2009 18:51:44 +0200 | |
changeset 2575 | e033939d5664 |
parent 1977 | 606923dff11b |
child 2647 | b0a2e779845c |
permissions | -rw-r--r-- |
0 | 1 |
"""Security hooks: check permissions to add/delete/update entities according to |
2 |
the user connected to a session |
|
3 |
||
4 |
:organization: Logilab |
|
1977
606923dff11b
big bunch of copyright / docstring update
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
1802
diff
changeset
|
5 |
:copyright: 2001-2009 LOGILAB S.A. (Paris, FRANCE), license is LGPL v2. |
0 | 6 |
:contact: http://www.logilab.fr/ -- mailto:contact@logilab.fr |
1977
606923dff11b
big bunch of copyright / docstring update
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
1802
diff
changeset
|
7 |
:license: GNU Lesser General Public License, v2.1 - http://www.gnu.org/licenses |
0 | 8 |
""" |
9 |
__docformat__ = "restructuredtext en" |
|
10 |
||
11 |
from cubicweb import Unauthorized |
|
12 |
from cubicweb.server.pool import LateOperation |
|
13 |
from cubicweb.server import BEFORE_ADD_RELATIONS, ON_COMMIT_ADD_RELATIONS |
|
14 |
||
15 |
def check_entity_attributes(session, entity): |
|
16 |
eid = entity.eid |
|
17 |
eschema = entity.e_schema |
|
18 |
# ._default_set is only there on entity creation to indicate unspecified |
|
19 |
# attributes which has been set to a default value defined in the schema |
|
20 |
defaults = getattr(entity, '_default_set', ()) |
|
21 |
for attr in entity.keys(): |
|
22 |
if attr in defaults: |
|
23 |
continue |
|
24 |
rschema = eschema.subject_relation(attr) |
|
25 |
if rschema.is_final(): # non final relation are checked by other hooks |
|
26 |
# add/delete should be equivalent (XXX: unify them into 'update' ?) |
|
27 |
rschema.check_perm(session, 'add', eid) |
|
1802
d628defebc17
delete-trailing-whitespace + some copyright update
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
479
diff
changeset
|
28 |
|
d628defebc17
delete-trailing-whitespace + some copyright update
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
479
diff
changeset
|
29 |
|
0 | 30 |
class CheckEntityPermissionOp(LateOperation): |
31 |
def precommit_event(self): |
|
32 |
#print 'CheckEntityPermissionOp', self.session.user, self.entity, self.action |
|
33 |
self.entity.check_perm(self.action) |
|
34 |
check_entity_attributes(self.session, self.entity) |
|
1802
d628defebc17
delete-trailing-whitespace + some copyright update
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
479
diff
changeset
|
35 |
|
0 | 36 |
def commit_event(self): |
37 |
pass |
|
1802
d628defebc17
delete-trailing-whitespace + some copyright update
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
479
diff
changeset
|
38 |
|
d628defebc17
delete-trailing-whitespace + some copyright update
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
479
diff
changeset
|
39 |
|
0 | 40 |
class CheckRelationPermissionOp(LateOperation): |
41 |
def precommit_event(self): |
|
42 |
self.rschema.check_perm(self.session, self.action, self.fromeid, self.toeid) |
|
1802
d628defebc17
delete-trailing-whitespace + some copyright update
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
479
diff
changeset
|
43 |
|
0 | 44 |
def commit_event(self): |
45 |
pass |
|
1802
d628defebc17
delete-trailing-whitespace + some copyright update
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
479
diff
changeset
|
46 |
|
0 | 47 |
def after_add_entity(session, entity): |
48 |
if not session.is_super_session: |
|
49 |
CheckEntityPermissionOp(session, entity=entity, action='add') |
|
50 |
||
51 |
def after_update_entity(session, entity): |
|
52 |
if not session.is_super_session: |
|
53 |
try: |
|
54 |
# check user has permission right now, if not retry at commit time |
|
55 |
entity.check_perm('update') |
|
56 |
check_entity_attributes(session, entity) |
|
57 |
except Unauthorized: |
|
475
b32a5772ff06
should clear local perm cache if first attempt failed
sylvain.thenault@logilab.fr
parents:
0
diff
changeset
|
58 |
entity.clear_local_perm_cache('update') |
0 | 59 |
CheckEntityPermissionOp(session, entity=entity, action='update') |
1802
d628defebc17
delete-trailing-whitespace + some copyright update
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
479
diff
changeset
|
60 |
|
0 | 61 |
def before_del_entity(session, eid): |
62 |
if not session.is_super_session: |
|
63 |
eschema = session.repo.schema[session.describe(eid)[0]] |
|
64 |
eschema.check_perm(session, 'delete', eid) |
|
65 |
||
66 |
||
67 |
def before_add_relation(session, fromeid, rtype, toeid): |
|
68 |
if rtype in BEFORE_ADD_RELATIONS and not session.is_super_session: |
|
69 |
rschema = session.repo.schema[rtype] |
|
70 |
rschema.check_perm(session, 'add', fromeid, toeid) |
|
1802
d628defebc17
delete-trailing-whitespace + some copyright update
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
479
diff
changeset
|
71 |
|
0 | 72 |
def after_add_relation(session, fromeid, rtype, toeid): |
73 |
if not rtype in BEFORE_ADD_RELATIONS and not session.is_super_session: |
|
74 |
rschema = session.repo.schema[rtype] |
|
75 |
if rtype in ON_COMMIT_ADD_RELATIONS: |
|
76 |
CheckRelationPermissionOp(session, action='add', rschema=rschema, |
|
77 |
fromeid=fromeid, toeid=toeid) |
|
78 |
else: |
|
79 |
rschema.check_perm(session, 'add', fromeid, toeid) |
|
80 |
||
81 |
def before_del_relation(session, fromeid, rtype, toeid): |
|
82 |
if not session.is_super_session: |
|
83 |
session.repo.schema[rtype].check_perm(session, 'delete', fromeid, toeid) |
|
84 |
||
85 |
def register_security_hooks(hm): |
|
86 |
"""register meta-data related hooks on the hooks manager""" |
|
87 |
hm.register_hook(after_add_entity, 'after_add_entity', '') |
|
88 |
hm.register_hook(after_update_entity, 'after_update_entity', '') |
|
89 |
hm.register_hook(before_del_entity, 'before_delete_entity', '') |
|
90 |
hm.register_hook(before_add_relation, 'before_add_relation', '') |
|
91 |
hm.register_hook(after_add_relation, 'after_add_relation', '') |
|
92 |
hm.register_hook(before_del_relation, 'before_delete_relation', '') |
|
1802
d628defebc17
delete-trailing-whitespace + some copyright update
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
479
diff
changeset
|
93 |