no access to private documents

pandora/config.indiancinema.jsonc

@@ -72,7 +72,7 @@
         "canSeeDebugMenu": {"researcher": true, "staff": true, "admin": true},
         "canSeeExtraItemViews": {"researcher": true, "staff": true, "admin": true},
         "canSeeMedia": {"researcher": true, "staff": true, "admin": true},
-        "canSeeDocument": {"guest": 3, "member": 3, "researcher": 3, "staff": 3, "admin": 3},
+        "canSeeDocument": {"guest": 1, "member": 1, "researcher": 2, "staff": 3, "admin": 3},
         "canSeeItem": {"guest": 3, "member": 3, "researcher": 3, "staff": 3, "admin": 3},
         "canSeeSize": {"researcher": true, "staff": true, "admin": true},
         "canSeeSoftwareVersion": {"researcher": true, "staff": true, "admin": true},

pandora/document/models.py

@@ -309,8 +309,18 @@ class Document(models.Model):
     def get_id(self):
         return ox.toAZ(self.id)
 
-    def accessible(self, user):
+    def access(self, user):
-        return self.user == user or self.status in ('public', 'featured')
+        if user.is_anonymous():
+            level = 'guest'
+        else:
+            level = user.profile.get_level()
+        editable = self.editable(user)
+        if editable:
+            return True
+        allowed_level = settings.CONFIG['capabilities']['canSeeDocument'][level]
+        if self.rightslevel <= allowed_level:
+            return True
+        return False
 
     def editable(self, user, item=None):
         if not user or user.is_anonymous():
@@ -339,6 +349,8 @@ class Document(models.Model):
                         'data-value',
                         'lang'
                     ])
+                elif key == 'rightslevel':
+                    setattr(self, key, int(data[key]))
                 elif ktype == 'text':
                     self.data[key] = ox.sanitize_html(data[key])
                 elif ktype == '[text]':
@@ -378,6 +390,7 @@ class Document(models.Model):
             'matches',
             'ratio',
             'size',
+            'rightslevel',
         ):
             return getattr(self, key)
         elif key == 'user':

pandora/document/views.py

@@ -27,13 +27,16 @@ from changelog.models import add_changelog
 
 from . import models
 
-def get_document_or_404_json(id):
+def get_document_or_404_json(request, id):
-    try:
-        return models.Document.get(id)
-    except:
     response = {'status': {'code': 404,
                            'text': 'Document not found'}}
+    try:
+        document = models.Document.get(id)
+    except:
         raise HttpErrorJson(response)
+    if not document.access(request.user):
+        raise HttpErrorJson(response)
+    return document
 
 @login_required_json
 def addDocument(request, data):
@@ -284,7 +287,7 @@ def getDocument(request, data):
     '''
     response = json_response({})
     data['keys'] = data.get('keys', [])
-    document = get_document_or_404_json(data['id'])
+    document = get_document_or_404_json(request, data['id'])
     response['data'] = document.json(keys=data['keys'], user=request.user)
     return render_to_json_response(response)
 actions.register(getDocument)
@@ -367,12 +370,12 @@ def sortDocuments(request, data):
 actions.register(sortDocuments, cache=False)
 
 def file(request, id, name=None):
-    document = models.Document.get(id)
+    document = get_document_or_404_json(request, id)
     return HttpFileResponse(document.file.path)
 
 def thumbnail(request, id, size=256, page=None):
     size = int(size)
-    document = get_document_or_404_json(id)
+    document = get_document_or_404_json(request, id)
     return HttpFileResponse(document.thumbnail(size, page=page))
 
 @login_required_json
@@ -400,7 +403,7 @@ def upload(request):
             file.extension = extension
             file.uploading = True
             file.save()
-        else:
+        elif file.editable(request.user):
             #replace existing file
             if file.file:
                 file.delete_cache()
@@ -411,6 +414,8 @@ def upload(request):
             file.width = -1
             file.pages = -1
             file.save()
+        else:
+            return render_to_json_response(response)
         upload_url = '/api/upload/document?id=%s' % file.get_id()
         return render_to_json_response({
             'uploadUrl': upload_url,

static/js/utils.js

@@ -1964,6 +1964,7 @@ pandora.getSpan = function(state, val, callback) {
     // fixme: "subtitles:23" is still missing
     Ox.Log('URL', 'getSpan', state, val);
     if (state.type == 'documents') {
+        if (state.item) {
             pandora.api.getDocument({
                 id: state.item,
                 keys: ['dimensions', 'extension']
@@ -1994,6 +1995,9 @@ pandora.getSpan = function(state, val, callback) {
                 Ox.Log('URL', 'getSpan result', state);
                 callback();
             });
+        } else {
+            callback();
+        }
     } else if (state.type == pandora.site.itemName.plural.toLowerCase()) {
         var isArray = Ox.isArray(val),
             isName, isVideoView, canBeAnnotation, canBeEvent, canBePlace;