r5419 - in branches/stability/cumin/python/cumin: . grid usergrid

Author: tmckay
Date: 2012-06-19 00:23:53 +0000 (Tue, 19 Jun 2012)
New Revision: 5419

Modified:
   branches/stability/cumin/python/cumin/grid/job.py
   branches/stability/cumin/python/cumin/grid/submission.py
   branches/stability/cumin/python/cumin/objectframe.py
   branches/stability/cumin/python/cumin/usergrid/widgets.py
Log:
Merge changes from trunk.
BZ769573 (mod)
svn merge -r 5415:HEAD svn+ssh://svn.fedorahosted.org/svn/cumin/trunk .


Modified: branches/stability/cumin/python/cumin/grid/job.py
===================================================================
--- branches/stability/cumin/python/cumin/grid/job.py	2012-06-18 21:16:28 UTC (rev 5418)
+++ branches/stability/cumin/python/cumin/grid/job.py	2012-06-19 00:23:53 UTC (rev 5419)
@@ -16,7 +16,7 @@
 from wooly import Widget, Parameter, Attribute
 from wooly.util import StringCatalog, Writer, escape_amp, escape_entity,\
     xml_escape
-from wooly.forms import Form, FormButton, StringField, NoXMLStringField
+from wooly.forms import Form, FormButton, StringField, NoXMLStringField, FormError
 from wooly.widgets import ModeSet, PropertySet, TemplateRenderer
 from wooly.template import WidgetTemplate
 from wooly.parameters import ListParameter, IntegerParameter, DictParameter
@@ -95,6 +95,10 @@
 
         return branch.marshal()
 
+    def not_viewable_redirect(self):
+        return (self.parent, 
+                "Logged in user does not own the specified job")
+
 class JobAdModes(ModeSet):
     def __init__(self, app, name):
         super(JobAdModes, self).__init__(app, name)
@@ -420,6 +424,25 @@
         reason = self.reason.render(session)
         return "<table
class=\"FormFieldSet\"><tbody>%s</tbody></table>%s" %
(reason, content)
 
+    def validate(self, session):
+        super(JobObjectSelectorTaskForm, self).validate(session)
+        if not self.errors.get(session) and \
+               self.app.authorizator.is_enforcing():
+            # Check here to make sure the logged in user owns
+            # the job or is an admin
+            login = session.client_session.attributes["login_session"]
+            if "admin" not in login.group:
+                user = login.user.name
+                submission_id = self.submission_id.get(session)
+                cls = self.app.model.com_redhat_grid.Submission
+                submission = cls.get_object_by_id(session.cursor, 
+                                                  submission_id)
+                if hasattr(submission, "Owner") and submission.Owner != user:
+                    f = FormError("The logged in user does not "\
+                                  "own this submission.")
+                    self.errors.add(session, f)
+
+
 class JobAdsSet(PropertySet):
     types = {0: "expression",
              1: "integer",
@@ -1110,6 +1133,22 @@
             self.task.invoke(session, scheduler, job_id, reason, submission)
             self.task.exit_with_redirect(session)
 
+    def validate(self, session):
+        super(JobActionForm, self).validate(session)
+        if not self.errors.get(session) and \
+               self.app.authorizator.is_enforcing():
+            # Check here to make sure the logged in user owns
+            # the job or is an admin
+            login = session.client_session.attributes["login_session"]
+            if "admin" not in login.group:
+                user = login.user.name
+                id = self.id.get(session)
+                submission = self.task.frame.get_submission(session, id)
+                if hasattr(submission, "Owner") and submission.Owner != user:
+                    f = FormError("The logged in user does not "\
+                                  "own this submission.")
+                    self.errors.add(session, f)
+
 class ReasonField(NoXMLStringField):
     def render_title(self, session):
         return "Reason"

Modified: branches/stability/cumin/python/cumin/grid/submission.py
===================================================================
--- branches/stability/cumin/python/cumin/grid/submission.py	2012-06-18 21:16:28 UTC (rev
5418)
+++ branches/stability/cumin/python/cumin/grid/submission.py	2012-06-19 00:23:53 UTC (rev
5419)
@@ -23,17 +23,30 @@
 log = logging.getLogger("cumin.grid.submission")
 
 class SubmissionFrame(ObjectFrame):
-    def __init__(self, app, name):
+    def __init__(self, app, name, check_viewable=False):
         cls = app.model.com_redhat_grid.Submission
 
         super(SubmissionFrame, self).__init__(app, name, cls)
 
+        # This will check whether or not the selected submission
+        # object is viewable by the logged in user during the
+        # processing pass.
+        self.do_check_viewable = check_viewable
+
         self.job = JobFrame(app, "job", self.object)
         self.add_mode(self.job)
 
+        # Ditto.  This will check whether the selected job
+        # is viewable by the logged in user.
+        self.job.do_check_viewable = check_viewable
+
         jobs = JobSelector(app, "jobs", self.object)
         self.view.add_tab(jobs)
 
+    def not_viewable_redirect(self):
+        return (self.parent, 
+                "Logged in user does not own the specified submission")
+
 class PoolSubmissionFrame(SubmissionFrame):
     # Use an ObjectView derivation here so that
     # SubmissionFrame can use a different summary class later on...

Modified: branches/stability/cumin/python/cumin/objectframe.py
===================================================================
--- branches/stability/cumin/python/cumin/objectframe.py	2012-06-18 21:16:28 UTC (rev
5418)
+++ branches/stability/cumin/python/cumin/objectframe.py	2012-06-19 00:23:53 UTC (rev
5419)
@@ -35,6 +35,8 @@
 
         self.tasks = list()
 
+        self.do_check_viewable = False
+
     def init(self):
         super(ObjectFrame, self).init()
 
@@ -56,19 +58,49 @@
 
         return "%s '%s'" % (obj._class._title, obj.get_title())
 
+    def not_viewable_redirect(self):
+        return (self.parent, 
+                "Logged in user does not own a specified object")
+
+    def check_viewable(self, obj, session):
+       login = session.client_session.attributes["login_session"]
+       user = login.user.name
+       okay = not hasattr(obj, "Owner") or obj.Owner == user
+       if okay:
+           frame = None
+           message = None
+       else:
+           frame, message = self.not_viewable_redirect()
+       return okay, frame, message
+
+    def set_redirect(self, session, frame, message):
+        nsession = session.branch()
+        frame.view.show(nsession)
+        url = nsession.marshal()
+        self.page.redirect.set(session, url)
+        session.add_notice(Notice(message))
+
     def do_process(self, session):
         # XXX don't process if this frame is invisible
 
         id = self.id.get(session)
-
         assert id
 
         obj = self.get_object(session, id)
-
         self.object.set(session, obj)
 
-        super(ObjectFrame, self).do_process(session)
-
+        # If the check is turned on, see if the object can be
+        # viewed by the session.  The check_viewable method will
+        # return a status, as well as a frame to redirect to and 
+        # a message if the status is false
+        okay = not self.do_check_viewable or obj is None
+        if not okay:
+            okay, frame, message = self.check_viewable(obj, session)
+        if okay:
+            super(ObjectFrame, self).do_process(session)
+        else:
+            self.set_redirect(session, frame, message)
+ 
     def get_object(self, session, id):
         return self.cls.get_object_by_id(session.cursor, id)
 

Modified: branches/stability/cumin/python/cumin/usergrid/widgets.py
===================================================================
--- branches/stability/cumin/python/cumin/usergrid/widgets.py	2012-06-18 21:16:28 UTC (rev
5418)
+++ branches/stability/cumin/python/cumin/usergrid/widgets.py	2012-06-19 00:23:53 UTC (rev
5419)
@@ -95,7 +95,8 @@
         self.view = UserSubmissionSelector(app, "view", user)
         self.add_mode(self.view)
 
-        self.submission = SubmissionFrame(app, "submission")
+        self.submission = SubmissionFrame(app, "submission", 
+                                          check_viewable=True)
         self.add_mode(self.submission)
 
     def render_title(self, session):