No Description
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

decorators.py 3.3KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108
  1. # This file is part of k4ever, a point-of-sale system
  2. # Contact............ <k4ever@lists.someserver.de>
  3. # Website............ http://k4ever.someserver.de/
  4. # Bug tracker........ http://k4ever.someserver.de/report
  5. #
  6. # Licensed under GNU Affero General Public License v3 or later
  7. from functools import wraps
  8. from django.contrib.auth.models import User, Group
  9. from piston.utils import rc
  10. from main.models import Plugin, PluginPermission
  11. from settings import PLUGIN_GROUP_ID
  12. def manglePluginPerms(apiFunc):
  13. """ Changes to a given user when the authenticated user is an plugin.
  14. When the user which called the apifunc is a plugin this function
  15. goes through the following steps:
  16. - searches the user it should change to
  17. - checks if this user allowed the plugin to "speak for him"
  18. - change the request so it looks like the user called himself
  19. - add an plugin_user entry containing the previous request user
  20. This decorator is intended to be used with django piston, so on error
  21. it will return the appropriate rc.* values.
  22. """
  23. @wraps(apiFunc)
  24. def wrapper(self, request, *args, **kwargs):
  25. if request.method != 'GET':
  26. if not request.content_type:
  27. request.data = request.POST
  28. else:
  29. request.data = request.GET
  30. # 0. is user a plugin?
  31. try:
  32. group = request.user.groups.get(name="Plugin")
  33. except Group.DoesNotExist:
  34. # user is not a plugin, exec the apiFunc
  35. return apiFunc(self, request, *args, **kwargs)
  36. # get the plugin for the user
  37. # FIXME: Could throw exception when we have no plugin for the
  38. # user - where should we report this?
  39. plugin = Plugin.objects.get(user=request.user)
  40. # 1. find user!
  41. user = None
  42. try:
  43. user = User.objects.get(username=request.data.get('user', ''))
  44. except User.DoesNotExist:
  45. ret = rc.NOT_HERE
  46. ret.write("\nThe user you requested could not be found\n")
  47. return ret
  48. # 2. does the plugin has permission for this user?
  49. perms = None
  50. try:
  51. perms = PluginPermission.objects.get(user=user, plugin=plugin)
  52. except PluginPermission.DoesNotExist:
  53. ret = rc.FORBIDDEN
  54. ret.write("\nThe user did not grant you permission to act on his behalf\n")
  55. return ret
  56. # 3. put stuff into the request
  57. request.user = user
  58. request.plugin = plugin
  59. request.pluginperms = perms
  60. return apiFunc(self, request, *args, **kwargs)
  61. return wrapper
  62. def requirePlugin(apiFunc):
  63. """Check if user is a plugin.
  64. Checks if the user is a member of the "Plugin" Group. Returns a rc.FORBIDDEN
  65. if not.
  66. """
  67. @wraps(apiFunc)
  68. def wrapper(self, request, *args, **kwargs):
  69. try:
  70. if request.user:
  71. group = request.user.groups.get(pk=PLUGIN_GROUP_ID)
  72. # no exception, exec apiFunc!
  73. request.plugin = Plugin.objects.get(user=request.user)
  74. return apiFunc(self, request, *args, **kwargs)
  75. except Group.DoesNotExist:
  76. pass
  77. ret = rc.FORBIDDEN
  78. ret.write("\nA plugin is required for this api function\n")
  79. return ret
  80. return wrapper
  81. def fix_mime(mime_func):
  82. """ Fix mimetype by truncating everything behind a ';'.
  83. This is used to fix pistons ``piston.utils.Mimer.content_type``."""
  84. @wraps(mime_func)
  85. def wrapper(self):
  86. ctype = self.request.META.get('CONTENT_TYPE', None)
  87. if ctype and ctype.find(";") >= 0:
  88. ctype = self.request.META['CONTENT_TYPE'] = ctype.split(";")[0]
  89. return mime_func(self)
  90. return wrapper