Mercurial Mercurial > pub > hg > cubicweb / changeset
summary | shortlog | changelog | graph | tags | bookmarks | branches | files | changeset | raw | zip | gz | bz2 | help
Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
[autoform] we should consider role when checking delete permission stable
authorSylvain Thénault <sylvain.thenault@logilab.fr>
Mon, 15 Feb 2010 15:16:08 +0100
branchstable
changeset 4579 19d73051eb57
parent 4578 060c91ced72f
child 4580 9fce32b5d219
[autoform] we should consider role when checking delete permission
web/views/autoform.py file | annotate | diff | comparison | revisions 
--- a/web/views/autoform.py	Mon Feb 15 15:14:50 2010 +0100
+++ b/web/views/autoform.py	Mon Feb 15 15:16:08 2010 +0100
@@ -384,7 +384,11 @@
             related = []
             if entity.has_eid():
                 rset = entity.related(rschema, role, limit=form.related_limit)
-                if rschema.has_perm(form._cw, 'delete'):
+                if role == 'subject':
+                    haspermkwargs = {'fromeid': entity.eid}
+                else:
+                    haspermkwargs = {'toeid': entity.eid}
+                if rschema.has_perm(form._cw, 'delete', **haspermkwargs):
                     toggleable_rel_link_func = toggleable_relation_link
                 else:
                     toggleable_rel_link_func = lambda x, y, z: u''
cubicweb