0x2620/pandora
2
1
Fork 1
Code Issues 1.3k Pull requests Releases Wiki Activity

only list items/documents < max level

Browse source
This commit is contained in:
j 2023-01-05 14:03:44 +00:00
parent 623bbd472c
commit 873ec27803
3 changed files with 7 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
pandora/document/managers/__init__.py
View file

@ -298,6 +298,8 @@ class DocumentManager(Manager):
q |= Q(groups__in=user.groups.all())
rendered_q |= Q(groups__in=user.groups.all())
qs = qs.filter(q)
max_level = len(settings.CONFIG['documentRightsLevels'])
qs = qs.filter(rightslevel__lte=max_level)
return qs

3
pandora/document/models.py
View file

@ -327,6 +327,9 @@ class Document(models.Model, FulltextMixin):
def editable(self, user, item=None):
if not user or user.is_anonymous:
return False
max_level = len(settings.CONFIG['rightsLevels'])
if self.level > max_level:
return False
if self.user == user or \
self.groups.filter(id__in=user.groups.all()).count() > 0 or \
user.is_staff or \

2
pandora/item/managers.py
View file

@ -318,6 +318,8 @@ class ItemManager(Manager):
q |= Q(groups__in=user.groups.all())
rendered_q |= Q(groups__in=user.groups.all())
qs = qs.filter(q)
max_level = len(settings.CONFIG['rightsLevels'])
qs = qs.filter(level__lte=max_level)
if settings.CONFIG.get('itemRequiresVideo') and level != 'admin':
qs = qs.filter(rendered_q)
return qs