Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit89702f0

Browse files
committed
now apijson get OWNER role should be given in parameters explicitly; code 401 change to 400
1 parent7228135 commit89702f0

File tree

2 files changed

+49
-74
lines changed

2 files changed

+49
-74
lines changed

‎demo/apps/apijson_demo/views.py

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -11,25 +11,28 @@ def index():
1111

1212
request_get= [
1313
{
14-
"label":"Single record query:no parameter",
14+
"label":"Single record query:self user",
1515
"value":'''{
1616
"user":{
17+
"@role":"OWNER"
1718
}
1819
}''',
1920
},
2021
{
2122
"label":"Single record query: with id as parameter",
2223
"value":'''{
2324
"user":{
24-
"id":1
25+
"id":2,
26+
"@role":"ADMIN"
2527
}
2628
}''',
2729
},
2830
{
2931
"label":"Single record query: @column",
3032
"value":'''{
3133
"user":{
32-
"@column": "id,username,email"
34+
"@column": "id,username,email",
35+
"@role":"OWNER"
3336
}
3437
}''',
3538
},
@@ -41,7 +44,8 @@ def index():
4144
"@page":0,
4245
"user":{
4346
"@column":"id,username,nickname,email",
44-
"@order":"id-"
47+
"@order":"id-",
48+
"@role":"ADMIN"
4549
}
4650
}
4751
}''',

‎uliweb_apijson/apijson/views.py

Lines changed: 41 additions & 70 deletions
Original file line numberDiff line numberDiff line change
@@ -44,45 +44,30 @@ def _get_one(self,key):
4444
model_column_set=None
4545
q=model.all()
4646

47-
GET=model_setting.get("GET",{})
47+
GET=model_setting.get("GET")
4848
ifnotGET:
49-
returnjson({"code":401,"msg":"'%s' not accessible"%(modelname)})
49+
returnjson({"code":400,"msg":"'%s' not accessible"%(modelname)})
5050

5151
roles=GET.get("roles")
52-
perms=GET.get("perms")
5352
permission_check_ok=False
54-
user_role=None
55-
ifparams_role:
56-
ifparams_rolenotinroles:
57-
returnjson({"code":401,"msg":"'%s' not accessible by role '%s'"%(modelname,params_role)})
58-
iffunctions.has_role(request.user,params_role):
59-
permission_check_ok=True
60-
user_role=params_role
53+
ifnotparams_role:
54+
ifrequest.user:
55+
params_role="LOGIN"
6156
else:
62-
returnjson({"code":401,"msg":"user doesn't have role '%s'"%(params_role)})
63-
ifnotpermission_check_okandroles:
64-
forroleinroles:
65-
iffunctions.has_role(request.user,role):
66-
permission_check_ok=True
67-
user_role=role
68-
break
69-
70-
ifnotpermission_check_okandperms:
71-
forperminperms:
72-
iffunctions.has_permission(request.user,perm):
73-
permission_check_ok=True
74-
break
75-
57+
params_role="UNKNOWN"
58+
ifparams_rolenotinroles:
59+
returnjson({"code":400,"msg":"'%s' not accessible by role '%s'"%(modelname,params_role)})
60+
iffunctions.has_role(request.user,params_role):
61+
permission_check_ok=True
62+
else:
63+
returnjson({"code":400,"msg":"user doesn't have role '%s'"%(params_role)})
7664
ifnotpermission_check_ok:
77-
returnjson({"code":401,"msg":"no permission"})
78-
79-
filtered=False
65+
returnjson({"code":400,"msg":"no permission"})
8066

81-
ifuser_role=="OWNER":
67+
ifparams_role=="OWNER":
8268
owner_filtered,q=self._filter_owner(model,model_setting,q)
8369
ifnotowner_filtered:
84-
returnjson({"code":401,"msg":"'%s' cannot filter with owner"%(modelname)})
85-
filtered=True
70+
returnjson({"code":400,"msg":"'%s' cannot filter with owner"%(modelname)})
8671

8772
params=self.request_data[key]
8873
ifisinstance(params,dict):
@@ -92,12 +77,8 @@ def _get_one(self,key):
9277
model_column_set=set(params[n].split(","))
9378
elifhasattr(model,n):
9479
q=q.filter(getattr(model.c,n)==params[n])
95-
filtered=True
9680
else:
9781
returnjson({"code":400,"msg":"'%s' have no attribute '%s'"%(modelname,n)})
98-
#default filter is trying to filter with owner
99-
ifnotfilteredandrequest.user:
100-
owner_filtered,q=self._filter_owner(model,model_setting,q)
10182
o=q.one()
10283
ifo:
10384
o=o.to_dict()
@@ -166,45 +147,32 @@ def _get_array(self,key):
166147

167148
q=model.all()
168149

169-
#rbac check begin
170-
GET=model_setting.get("GET",{})
150+
GET=model_setting.get("GET")
171151
ifnotGET:
172-
returnjson({"code":401,"msg":"'%s' not accessible by apijson"%(modelname)})
152+
returnjson({"code":400,"msg":"'%s' not accessible by apijson"%(modelname)})
173153

174154
roles=GET.get("roles")
175-
perms=GET.get("perms")
176-
params_role=params.get("@role")
155+
params_role=model_param.get("@role")
177156
permission_check_ok=False
178-
user_role=None
179-
ifparams_role:
180-
ifparams_rolenotinroles:
181-
returnjson({"code":401,"msg":"'%s' not accessible by role '%s'"%(modelname,params_role)})
182-
iffunctions.has_role(request.user,params_role):
183-
permission_check_ok=True
184-
user_role=params_role
157+
ifnotparams_role:
158+
ifrequest.user:
159+
params_role="LOGIN"
185160
else:
186-
returnjson({"code":401,"msg":"user doesn't have role '%s'"%(params_role)})
187-
ifnotpermission_check_okandroles:
188-
forroleinroles:
189-
iffunctions.has_role(request.user,role):
190-
permission_check_ok=True
191-
user_role=role
192-
break
193-
194-
ifnotpermission_check_okandperms:
195-
forperminperms:
196-
iffunctions.has_permission(request.user,perm):
197-
permission_check_ok=True
198-
break
161+
params_role="UNKNOWN"
162+
ifparams_rolenotinroles:
163+
returnjson({"code":400,"msg":"'%s' not accessible by role '%s'"%(modelname,params_role)})
164+
iffunctions.has_role(request.user,params_role):
165+
permission_check_ok=True
166+
else:
167+
returnjson({"code":400,"msg":"user doesn't have role '%s'"%(params_role)})
199168

200169
ifnotpermission_check_ok:
201-
returnjson({"code":401,"msg":"no permission"})
202-
#rbac check end
170+
returnjson({"code":400,"msg":"no permission"})
203171

204-
ifuser_role=="OWNER":
172+
ifparams_role=="OWNER":
205173
owner_filtered,q=self._filter_owner(model,model_setting,q)
206174
ifnotowner_filtered:
207-
returnjson({"code":401,"msg":"'%s' cannot filter with owner"%(modelname)})
175+
returnjson({"code":400,"msg":"'%s' cannot filter with owner"%(modelname)})
208176

209177
ifquery_count:
210178
ifquery_page:
@@ -271,9 +239,9 @@ def _head(self,key):
271239

272240
q=model.all()
273241

274-
HEAD=model_setting.get("HEAD",{})
242+
HEAD=model_setting.get("HEAD")
275243
ifnotHEAD:
276-
returnjson({"code":401,"msg":"'%s' not accessible"%(modelname)})
244+
returnjson({"code":400,"msg":"'%s' not accessible"%(modelname)})
277245

278246
roles=HEAD.get("roles")
279247
permission_check_ok=False
@@ -283,11 +251,14 @@ def _head(self,key):
283251
else:
284252
params_role="UNKNOWN"
285253
ifparams_rolenotinroles:
286-
returnjson({"code":401,"msg":"'%s' not accessible by role '%s'"%(modelname,params_role)})
254+
returnjson({"code":400,"msg":"'%s' not accessible by role '%s'"%(modelname,params_role)})
287255
iffunctions.has_role(request.user,params_role):
288256
permission_check_ok=True
289257
else:
290-
returnjson({"code":401,"msg":"user doesn't have role '%s'"%(params_role)})
258+
returnjson({"code":400,"msg":"user doesn't have role '%s'"%(params_role)})
259+
ifnotpermission_check_ok:
260+
returnjson({"code":400,"msg":"no permission"})
261+
291262
ifparams_role=="OWNER":
292263
owner_filtered,q=self._filter_owner(model,model_setting,q)
293264
ifnotowner_filtered:
@@ -352,7 +323,7 @@ def _post_one(self,key,tag):
352323
roles=POST.get("roles")
353324
ifparams_role:
354325
ifnotparams_roleinroles:
355-
returnjson({"code":401,"msg":"'%s' not accessible by role '%s'"%(modelname,params_role)})
326+
returnjson({"code":400,"msg":"'%s' not accessible by role '%s'"%(modelname,params_role)})
356327
roles= [params_role]
357328

358329
ifroles:
@@ -462,7 +433,7 @@ def _put_one(self,key,tag):
462433
roles=PUT.get("roles")
463434
ifparams_role:
464435
ifnotparams_roleinroles:
465-
returnjson({"code":401,"msg":"'%s' not accessible by role '%s'"%(modelname,params_role)})
436+
returnjson({"code":400,"msg":"'%s' not accessible by role '%s'"%(modelname,params_role)})
466437
roles= [params_role]
467438
ifroles:
468439
forroleinroles:
@@ -560,7 +531,7 @@ def _delete_one(self,key,tag):
560531
roles=DELETE.get("roles")
561532
ifparams_role:
562533
ifnotparams_roleinroles:
563-
returnjson({"code":401,"msg":"'%s' not accessible by role '%s'"%(modelname,params_role)})
534+
returnjson({"code":400,"msg":"'%s' not accessible by role '%s'"%(modelname,params_role)})
564535
roles= [params_role]
565536
ifroles:
566537
forroleinroles:

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp