fix permission checks in mailgw [SF#1263655]

Author: Richard Jones

CHANGES.txt

@@ -65,6 +65,7 @@ Fixed:
 - fix mangling of "_" in mail Subject class name (sf bug 1413852)
 - catch bad classname in URL (related to sf bug 1240541)
 - clean up digested_file_types (sf bug 1268303)
+- fix permission checks in mailgw (sf bug 1263655)
 
 
 2005-10-07 0.8.5

roundup/mailgw.py

@@ -72,7 +72,7 @@ class node. Any parts of other types are each stored in separate files
 an exception, the original message is bounced back to the sender with the
 explanatory message given in the exception.
 
-$Id: mailgw.py,v 1.170 2006-01-20 03:04:14 richard Exp $
+$Id: mailgw.py,v 1.171 2006-01-25 03:20:35 richard Exp $
 """
 __docformat__ = 'restructuredtext'
 
@@ -849,10 +849,14 @@ def handle_message(self, message):
                 raise Unauthorized, 'You are not permitted to access '\
                     'this tracker.'
 
-        # make sure they're allowed to edit this class of information
-        if not self.db.security.hasPermission('Edit', author, classname):
-            raise Unauthorized, 'You are not permitted to edit %s.'%classname
-
+        # make sure they're allowed to edit or create this class of information
+        if nodeid:
+            if not self.db.security.hasPermission('Edit', author, classname):
+                raise Unauthorized, 'You are not permitted to edit %s.'%classname
+        else:
+            if not self.db.security.hasPermission('Create', author, classname):
+                raise Unauthorized, 'You are not permitted to create %s.'%classname
+                
         # the author may have been created - make sure the change is
         # committed before we reopen the database
         self.db.commit()
@@ -946,6 +950,8 @@ def handle_message(self, message):
         if properties.has_key('files'):
             files = []
             for (name, mime_type, data) in attachments:
+                if not self.db.security.hasPermission('Create', author, 'file'):
+                    raise Unauthorized, 'You are not permitted to create files.'
                 if not name:
                     name = "unnamed"
                 try:
@@ -956,6 +962,9 @@ def handle_message(self, message):
                 else:
                     files.append(fileid)
             # attach the files to the issue
+            if not self.db.security.hasPermission('Edit', author, classname, 'files'):
+                raise Unauthorized, 'You are not permitted to add files to %s.'%classname
+
             if nodeid:
                 # extend the existing files list
                 fileprop = cl.get(nodeid, 'files')
@@ -969,6 +978,9 @@ def handle_message(self, message):
         # create the message if there's a message body (content)
         #
         if (content and properties.has_key('messages')):
+            if not self.db.security.hasPermission('Create', author, 'msg'):
+                raise Unauthorized, 'You are not permitted to create messages.'
+
             try:
                 message_id = self.db.msg.create(author=author,
                     recipients=recipients, date=date.Date('.'),
@@ -980,6 +992,9 @@ def handle_message(self, message):
 %s
 '''%error
             # attach the message to the node
+            if not self.db.security.hasPermission('Edit', author, classname, 'messages'):
+                raise Unauthorized, 'You are not permitted to add messages to %s.'%classname
+
             if nodeid:
                 # add the message to the node's list
                 messages = cl.get(nodeid, 'messages')
@@ -999,6 +1014,12 @@ def handle_message(self, message):
             for prop in issue_props.keys() :
                 if not props.has_key(prop) :
                     props[prop] = issue_props[prop]
+
+            # Check permissions for each property
+            for prop in props.keys():
+                if not self.db.security.hasPermission('Edit', author, classname, prop):
+                    raise Unauthorized, 'You are not permitted to edit property %s of class %s.'%(prop,classname)
+
             if nodeid:
                 cl.set(nodeid, **props)
             else: