2025-summer/team-3
12
Fork 0
Code Issues Pull requests Projects Releases Activity

remove code that gave all access permissions to superusers

Browse source
This commit is contained in:
Laura Klünder 2017-12-08 22:32:35 +01:00
parent 10af523737
commit 0c1b27d529
1 changed files with 2 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

11
src/c3nav/mapdata/models/access.py
View file

@ -26,9 +26,7 @@ class AccessRestriction(TitledMixin, models.Model):
@classmethod @classmethod
def qs_for_request(cls, request): def qs_for_request(cls, request):
if request.user.is_authenticated and request.user.is_superuser: return cls.objects.all()
return cls.objects.all()
return cls.objects.none()
class AccessPermission(models.Model): class AccessPermission(models.Model):
@ -71,11 +69,6 @@ class AccessPermission(models.Model):
@classmethod @classmethod
def cache_key_for_request(cls, request, with_update=True): def cache_key_for_request(cls, request, with_update=True):
if request.user.is_superuser:
return (
((MapUpdate.current_cache_key() + ':') if with_update else '') +
'SU'
)
return ( return (
((MapUpdate.current_cache_key()+':') if with_update else '') + ((MapUpdate.current_cache_key()+':') if with_update else '') +
','.join(str(i) for i in sorted(AccessPermission.get_for_request(request)) or '0') ','.join(str(i) for i in sorted(AccessPermission.get_for_request(request)) or '0')
@ -121,7 +114,7 @@ class AccessRestrictionMixin(SerializableMixin, models.Model):
@classmethod @classmethod
def q_for_request(cls, request, prefix='', allow_none=False): def q_for_request(cls, request, prefix='', allow_none=False):
if request is None and allow_none or request.user.is_superuser: if request is None and allow_none:
return Q() return Q()
return (Q(**{prefix+'access_restriction__isnull': True}) | return (Q(**{prefix+'access_restriction__isnull': True}) |
Q(**{prefix+'access_restriction__pk__in': AccessPermission.get_for_request(request)})) Q(**{prefix+'access_restriction__pk__in': AccessPermission.get_for_request(request)}))