merge from HEAD

Author: Richard Jones

CHANGES.txt

@@ -7,6 +7,7 @@ Fixed:
 - fix API for templating utils extensions - remove "utils" arg (sf bug 1081981)
 - back_sqlite.py is missing "import time" (sf bug 1081959)
 - fix (list) popup (sf bug 1083570)
+- fix some security assertions (sf bug 1085481)
 
 
 2004-12-08 0.8.0b1

roundup/cgi/actions.py

@@ -1,4 +1,4 @@
-#$Id: actions.py,v 1.40 2004-11-23 22:45:13 richard Exp $
+#$Id: actions.py,v 1.40.2.1 2004-12-15 00:03:36 richard Exp $
 
 import re, cgi, StringIO, urllib, Cookie, time, random
 
@@ -59,12 +59,12 @@ def permission(self):
                 '%(action)s the %(classname)s class.')%info
 
     _marker = []
-    def hasPermission(self, permission, classname=_marker):
+    def hasPermission(self, permission, classname=_marker, itemid=None):
         """Check whether the user has 'permission' on the current class."""
         if classname is self._marker:
             classname = self.client.classname
         return self.db.security.hasPermission(permission, self.client.userid,
-            classname)
+            classname=classname, itemid=itemid)
 
     def gettext(self, msgid):
         """Return the localized translation of msgid"""
@@ -158,9 +158,16 @@ def handle(self):
                 # edit the old way, only one query per name
                 try:
                     qid = self.db.query.lookup(queryname)
+                    if not self.hasPermission('Edit', self.classname,
+                            itemid=qid):
+                        raise exceptions.Unauthorised, self._(
+                            "You do not have permission to edit queries")
                     self.db.query.set(qid, klass=self.classname, url=url)
                 except KeyError:
                     # create a query
+                    if not self.hasPermission('Create', self.classname):
+                        raise exceptions.Unauthorised, self._(
+                            "You do not have permission to store queries")
                     qid = self.db.query.create(name=queryname,
                         klass=self.classname, url=url)
             else:
@@ -180,9 +187,16 @@ def handle(self):
                     for qid in qids:
                         if queryname != self.db.query.get(qid, 'name'):
                             continue
+                        if not self.hasPermission('Edit', self.classname,
+                                itemid=qid):
+                            raise exceptions.Unauthorised, self._(
+                            "You do not have permission to edit queries")
                         self.db.query.set(qid, klass=self.classname, url=url)
                 else:
                     # create a query
+                    if not self.hasPermission('Create', self.classname):
+                        raise exceptions.Unauthorised, self._(
+                            "You do not have permission to store queries")
                     qid = self.db.query.create(name=queryname,
                         klass=self.classname, url=url, private_for=uid)
 
@@ -468,7 +482,7 @@ def editItemPermission(self, props):
                     "You do not have permission to edit user roles")
             if self.isEditingSelf():
                 return 1
-        if self.hasPermission('Edit'):
+        if self.hasPermission('Edit', itemid=self.nodeid):
             return 1
         return 0
 

templates/classic/html/issue.search.html

@@ -180,7 +180,7 @@
 </td>
 </tr>
 
-<tr>
+<tr tal:condition="python:request.user.hasPermission('Edit', 'query')">
 <th i18n:translate="">Query name**:</th>
 <td><input name="@queryname"
            tal:attributes="value request/form/@queryname/value | default"></td>

templates/classic/html/page.html

@@ -24,7 +24,8 @@ <h2><span metal:define-slot="body_title">body title</span></h2>
 
 <tr>
  <td rowspan="2" valign="top" class="sidebar">
-  <p class="classblock">
+  <p class="classblock"
+     tal:condition="python:request.user.hasPermission('View', 'query')">
    <span i18n:translate=""
     ><b>Your Queries</b> (<a href="query?@template=edit">edit</a>)</span><br>
    <tal:block tal:repeat="qs request/user/queries">