[security] allow to call .check on rql expression with a user eid specified stable
authorSylvain Thénault <sylvain.thenault@logilab.fr>
Wed, 17 Feb 2010 20:22:12 +0100
branchstable
changeset 4619 f4254586e867
parent 4618 412a9f1f5fd0
child 4620 c4adfc2466f5
child 4623 994c70fe5006
[security] allow to call .check on rql expression with a user eid specified
schema.py
--- a/schema.py	Wed Feb 17 16:42:52 2010 +0100
+++ b/schema.py	Wed Feb 17 20:22:12 2010 +0100
@@ -806,9 +806,8 @@
             # on the server side, use unsafe_execute, but this is not available
             # on the client side (session is actually a request)
             execute = getattr(session, 'unsafe_execute', session.execute)
-            # XXX what if 'u' in kwargs
+            kwargs.setdefault('u', session.user.eid)
             cachekey = kwargs.keys()
-            kwargs['u'] = session.user.eid
             try:
                 rset = execute(rql, kwargs, cachekey, build_descr=True)
             except NotImplementedError:
@@ -872,15 +871,15 @@
             rql += ', U eid %(u)s'
         return rql
 
-    def check(self, session, eid=None, creating=False):
+    def check(self, session, eid=None, creating=False, **kwargs):
         if 'X' in self.rqlst.defined_vars:
             if eid is None:
                 if creating:
-                    return self._check(session, creating=True)
+                    return self._check(session, creating=True, **kwargs)
                 return False
             assert creating == False
-            return self._check(session, x=eid)
-        return self._check(session)
+            return self._check(session, x=eid, **kwargs)
+        return self._check(session, **kwargs)
 
 
 class RRQLExpression(RQLExpression):