[selector] check read perm if action is add/update/delete stable
authorSylvain Thénault <sylvain.thenault@logilab.fr>
Mon, 21 Sep 2009 18:00:28 +0200
branchstable
changeset 3345 10ad3869fc92
parent 3344 699949007fc2
child 3346 b1fd9d4ef579
[selector] check read perm if action is add/update/delete
selectors.py
--- a/selectors.py	Mon Sep 21 17:59:22 2009 +0200
+++ b/selectors.py	Mon Sep 21 18:00:28 2009 +0200
@@ -669,6 +669,10 @@
         if not (rschema.has_perm(req, self.action)
                 or rschema.has_local_role(self.action)):
             return 0
+        if self.action != 'read':
+            if not (rschema.has_perm(req, 'read')
+                    or rschema.has_local_role('read')):
+                return 0
         score = super(relation_possible, self).__call__(cls, req, *args, **kwargs)
         return score