2025-summer/team-3
12
Fork 0
Code Issues Pull requests Projects Releases Activity

fix space edit permission check

Browse source
This commit is contained in:
Gwendolyn 2024-12-26 20:09:04 +01:00
parent 0e6faa0673
commit f656ad7a3a
1 changed files with 12 additions and 19 deletions
Download patch file Download diff file Expand all files Collapse all files

31
src/c3nav/editor/models/changeset.py
View file

@ -211,7 +211,7 @@ class ChangeSet(models.Model):
result = True result = True
for model_name, objects in self.changes.objects.items(): for model_name, objects in self.changes.objects.items():
model = apps.get_model('mapdata', model_name) model = apps.get_model('mapdata', model_name)
if issubclass(model, (LocationRedirect, LocationSlug)): if issubclass(model, LocationRedirect):
continue continue
if issubclass(model, DataOverlay): if issubclass(model, DataOverlay):
@ -241,36 +241,29 @@ class ChangeSet(models.Model):
result = False result = False
break break
for obj in objects: ids = [obj.obj.id for obj in objects.values()]
if obj.space_id not in can_edit_spaces: space_ids = set(model.objects.filter(pk__in=ids).values_list('space_id', flat=True))
result = False
break
if not result:
break
try: try:
model._meta.get_field('origin_space') model._meta.get_field('origin_space')
except FieldDoesNotExist: except FieldDoesNotExist:
pass pass
else: else:
for obj in objects: ids = [obj.obj.id for obj in objects.values()]
if obj.origin_space_id not in can_edit_spaces: space_ids += set(model.objects.filter(pk__in=ids).values_list('origin_space_id', flat=True))
result = False
break
if not result:
break
try: try:
model._meta.get_field('target_space') model._meta.get_field('target_space')
except FieldDoesNotExist: except FieldDoesNotExist:
pass pass
else: else:
for obj in objects: ids = [obj.obj.id for obj in objects.values()]
if obj.target_space_id not in can_edit_spaces: space_ids += set(model.objects.filter(pk__in=ids).values_list('target_space_id', flat=True))
result = False
break if space_ids - can_edit_spaces:
if not result: result = False
break break
request._has_edit_access_on_all_objects_cache[self.pk] = result request._has_edit_access_on_all_objects_cache[self.pk] = result
return result return result