r5416 - in trunk: cumin/python/cumin cumin/python/cumin/grid cumin/python/cumin/usergrid wooly/python/wooly

Author: tmckay
Date: 2012-06-18 16:29:47 +0000 (Mon, 18 Jun 2012)
New Revision: 5416

Modified:
   trunk/cumin/python/cumin/grid/job.py
   trunk/cumin/python/cumin/grid/submission.py
   trunk/cumin/python/cumin/objectframe.py
   trunk/cumin/python/cumin/usergrid/widgets.py
   trunk/wooly/python/wooly/__init__.py
Log:
Role enforcement tweaks.
BZ769573 (mod)


Modified: trunk/cumin/python/cumin/grid/job.py
===================================================================
--- trunk/cumin/python/cumin/grid/job.py	2012-06-14 20:14:04 UTC (rev 5415)
+++ trunk/cumin/python/cumin/grid/job.py	2012-06-18 16:29:47 UTC (rev 5416)
@@ -97,6 +97,10 @@
 
         return branch.marshal()
 
+    def not_viewable_redirect(self):
+        return (self.parent, 
+                "Logged in user does not own the specified job")
+
 class JobAdModes(ModeSet):
     def __init__(self, app, name):
         super(JobAdModes, self).__init__(app, name)

Modified: trunk/cumin/python/cumin/grid/submission.py
===================================================================
--- trunk/cumin/python/cumin/grid/submission.py	2012-06-14 20:14:04 UTC (rev 5415)
+++ trunk/cumin/python/cumin/grid/submission.py	2012-06-18 16:29:47 UTC (rev 5416)
@@ -24,17 +24,30 @@
 log = logging.getLogger("cumin.grid.submission")
 
 class SubmissionFrame(ObjectFrame):
-    def __init__(self, app, name):
+    def __init__(self, app, name, check_viewable=False):
         cls = app.model.com_redhat_grid.Submission
 
         super(SubmissionFrame, self).__init__(app, name, cls)
 
+        # This will check whether or not the selected submission
+        # object is viewable by the logged in user during the
+        # processing pass.
+        self.do_check_viewable = check_viewable
+
         self.job = JobFrame(app, "job", self.object)
         self.add_mode(self.job)
 
+        # Ditto.  This will check whether the selected job
+        # is viewable by the logged in user.
+        self.job.do_check_viewable = check_viewable
+
         jobs = JobSelector(app, "jobs", self.object)
         self.view.add_tab(jobs)
 
+    def not_viewable_redirect(self):
+        return (self.parent, 
+                "Logged in user does not own the specified submission")
+
 class PoolSubmissionFrame(SubmissionFrame):
     # Use an ObjectView derivation here so that
     # SubmissionFrame can use a different summary class later on...

Modified: trunk/cumin/python/cumin/objectframe.py
===================================================================
--- trunk/cumin/python/cumin/objectframe.py	2012-06-14 20:14:04 UTC (rev 5415)
+++ trunk/cumin/python/cumin/objectframe.py	2012-06-18 16:29:47 UTC (rev 5416)
@@ -35,6 +35,8 @@
 
         self.tasks = list()
 
+        self.do_check_viewable = False
+
     def init(self):
         super(ObjectFrame, self).init()
 
@@ -56,19 +58,49 @@
 
         return "%s '%s'" % (obj._class._title, obj.get_title())
 
+    def not_viewable_redirect(self):
+        return (self.parent, 
+                "Logged in user does not own a specified object")
+
+    def check_viewable(self, obj, session):
+       login = session.client_session.attributes["login_session"]
+       user = login.user.name
+       okay = not hasattr(obj, "Owner") or obj.Owner == user
+       if okay:
+           frame = None
+           message = None
+       else:
+           frame, message = self.not_viewable_redirect()
+       return okay, frame, message
+
+    def set_redirect(self, session, frame, message):
+        nsession = session.branch()
+        frame.view.show(nsession)
+        url = nsession.marshal()
+        self.page.redirect.set(session, url)
+        session.add_notice(Notice(message))
+
     def do_process(self, session):
         # XXX don't process if this frame is invisible
 
         id = self.id.get(session)
-
         assert id
 
         obj = self.get_object(session, id)
-
         self.object.set(session, obj)
 
-        super(ObjectFrame, self).do_process(session)
-
+        # If the check is turned on, see if the object can be
+        # viewed by the session.  The check_viewable method will
+        # return a status, as well as a frame to redirect to and 
+        # a message if the status is false
+        okay = not self.do_check_viewable or obj is None
+        if not okay:
+            okay, frame, message = self.check_viewable(obj, session)
+        if okay:
+            super(ObjectFrame, self).do_process(session)
+        else:
+            self.set_redirect(session, frame, message)
+ 
     def _allow_none(self, session):
         try:
             return self.page.allow_object_not_found.get(session)

Modified: trunk/cumin/python/cumin/usergrid/widgets.py
===================================================================
--- trunk/cumin/python/cumin/usergrid/widgets.py	2012-06-14 20:14:04 UTC (rev 5415)
+++ trunk/cumin/python/cumin/usergrid/widgets.py	2012-06-18 16:29:47 UTC (rev 5416)
@@ -95,7 +95,8 @@
         self.view = UserSubmissionSelector(app, "view", user)
         self.add_mode(self.view)
 
-        self.submission = SubmissionFrame(app, "submission")
+        self.submission = SubmissionFrame(app, "submission", 
+                                          check_viewable=True)
         self.add_mode(self.submission)
 
     def render_title(self, session):

Modified: trunk/wooly/python/wooly/__init__.py
===================================================================
--- trunk/wooly/python/wooly/__init__.py	2012-06-14 20:14:04 UTC (rev 5415)
+++ trunk/wooly/python/wooly/__init__.py	2012-06-18 16:29:47 UTC (rev 5416)
@@ -510,11 +510,16 @@
         self.process(session)
 
         redirect = self.redirect.get(session)
+        if redirect:
+            raise PageRedirect()
 
+        rend = self.render(session)
+
+        redirect = self.redirect.get(session)
         if redirect:
             raise PageRedirect()
 
-        return self.render(session)
+        return rend
 
     def redirect_on_exception(self, session):
         return None