Commit8eeafbb

committed

more strict check to tag_POST; support DISALLOW in apijson_put

1 parentd1ff139 commit8eeafbbCopy full SHA for 8eeafbb

File tree

+12

-3

lines changed

+12

-3

lines changed

Lines changed: 12 additions & 3 deletions

Original file line number	Diff line number	Diff line change
`@@ -373,6 +373,8 @@ def _post_one(self,key,tag):`
`373`	`373`	`ifnotrequest_tag_config:`
`374`	`374`	`returnjson({"code":400,"msg":"tag '%s' not found"%(tag)})`
`375`	`375`	`tag_POST=request_tag_config.get("POST",{})`
	`376`	`+ifnottag_POST:`
	`377`	`+returnjson({"code":400,"msg":"tag '%s' not support apijson_post"%(tag)})`
`376`	`378`	`ADD=tag_POST.get("ADD")`
`377`	`379`	`ifADD:`
`378`	`380`	`ADD_role=ADD.get("@role")`
`@@ -501,9 +503,9 @@ def _put_one(self,key,tag):`
`501`	`503`	`returnjson({"code":400,"msg":"cannot find record id '%s'"%(id_)})`
`502`	`504`
`503`	`505`	`permission_check_ok=False`
`504`		`-PUT=model_setting.get("PUT")`
`505`		`-ifPUT:`
`506`		`-roles=PUT.get("roles")`
	`506`	`+model_PUT=model_setting.get("PUT")`
	`507`	`+ifmodel_PUT:`
	`508`	`+roles=model_PUT.get("roles")`
`507`	`509`	`ifparams_role:`
`508`	`510`	`ifnotparams_roleinroles:`
`509`	`511`	`returnjson({"code":400,"msg":"'%s' not accessible by role '%s'"%(modelname,params_role)})`
`@@ -529,6 +531,13 @@ def _put_one(self,key,tag):`
`529`	`531`	`ifnotpermission_check_ok:`
`530`	`532`	`returnjson({"code":400,"msg":"no permission"})`
`531`	`533`
	`534`	`+DISALLOW=tag_PUT.get("DISALLOW")`
	`535`	`+ifDISALLOW:`
	`536`	`+forfieldinDISALLOW:`
	`537`	`+iffieldinparams:`
	`538`	`+log.error("request '%s' disallow '%s'"%(tag,field))`
	`539`	`+returnjson({"code":400,"msg":"request '%s' disallow '%s'"%(tag,field)})`
	`540`	`+`
`532`	`541`	`kwargs= {}`
`533`	`542`	`forkinparams:`
`534`	`543`	`ifk=="id":`

Comments

(0)