web/views/actions.py
branchreldefsecurity
changeset 3877 7ca53fc72a0a
parent 3689 deb13e88e037
child 3890 d7a270f50f54
equal deleted inserted replaced
3876:1169d3154be6 3877:7ca53fc72a0a
   266         for role, rschemas in (('subject', eschema.subject_relations()),
   266         for role, rschemas in (('subject', eschema.subject_relations()),
   267                                ('object', eschema.object_relations())):
   267                                ('object', eschema.object_relations())):
   268             for rschema in rschemas:
   268             for rschema in rschemas:
   269                 if rschema.final:
   269                 if rschema.final:
   270                     continue
   270                     continue
   271                 # check the relation can be added as well
       
   272                 # XXX consider autoform_permissions_overrides?
       
   273                 if role == 'subject'and not rschema.has_perm(req, 'add',
       
   274                                                              fromeid=entity.eid):
       
   275                     continue
       
   276                 if role == 'object'and not rschema.has_perm(req, 'add',
       
   277                                                             toeid=entity.eid):
       
   278                     continue
       
   279                 # check the target types can be added as well
       
   280                 for teschema in rschema.targets(eschema, role):
   271                 for teschema in rschema.targets(eschema, role):
   281                     if not appearsin_addmenu.etype_get(eschema, rschema,
   272                     if not appearsin_addmenu.etype_get(eschema, rschema,
   282                                                        role, teschema):
   273                                                        role, teschema):
   283                         continue
   274                         continue
   284                     if teschema.has_local_role('add') or teschema.has_perm(req, 'add'):
   275                     rdef = rschema.role_rdef(eschema, teschema, role)
       
   276                     # check the relation can be added
       
   277                     # XXX consider autoform_permissions_overrides?
       
   278                     if role == 'subject'and not rdef.has_perm(
       
   279                         req, 'add', fromeid=entity.eid):
       
   280                         continue
       
   281                     if role == 'object'and not rdef.has_perm(
       
   282                         req, 'add', toeid=entity.eid):
       
   283                         continue
       
   284                     # check the target types can be added as well
       
   285                     if teschema.may_have_permission('add', req):
   285                         yield rschema, teschema, role
   286                         yield rschema, teschema, role
   286 
   287 
   287     def linkto_url(self, entity, rtype, etype, target):
   288     def linkto_url(self, entity, rtype, etype, target):
   288         return self.build_url('add/%s' % etype,
   289         return self.build_url('add/%s' % etype,
   289                               __linkto='%s:%s:%s' % (rtype, entity.eid, target),
   290                               __linkto='%s:%s:%s' % (rtype, entity.eid, target),