fixed bug in wiki can_manage
This commit is contained in:
@@ -1 +1 @@
|
||||
Version 2.0.8 (2012-09-09 21:39:52) stable
|
||||
Version 2.0.8 (2012-09-10 07:40:29) stable
|
||||
|
||||
+18
-13
@@ -4480,7 +4480,6 @@ class Expose(object):
|
||||
class Wiki(object):
|
||||
everybody = 'everybody'
|
||||
rows_page = 25
|
||||
regex_redirect = re.compile('redirect\s+(\w+\://\S+)\s*')
|
||||
def markmin_render(self,page):
|
||||
html = MARKMIN(page.body,url=True,environment=self.env,
|
||||
autolinks=lambda link: expand_one(link,{})).xml()
|
||||
@@ -4582,14 +4581,15 @@ class Wiki(object):
|
||||
# WIKI ACCESS POLICY
|
||||
def not_authorized(self,page=None):
|
||||
raise HTTP(401)
|
||||
def can_read(self,page):
|
||||
def can_read(self,page):
|
||||
if 'everybody' in page.can_read or not self.manage_permissions:
|
||||
return True
|
||||
elif self.auth.user:
|
||||
groups = self.auth.user_groups.values()
|
||||
if ('wiki_editor' in groups or
|
||||
set(groups).intersection(set(page.can_read+page.can_edit)) or
|
||||
page.created_by==self.auth.user.id): return True
|
||||
page.created_by==self.auth.user.id):
|
||||
return True
|
||||
return False
|
||||
def can_edit(self,page=None):
|
||||
if not self.auth.user: redirect(self.auth.settings.login_url)
|
||||
@@ -4600,7 +4600,8 @@ class Wiki(object):
|
||||
set(groups).intersection(set(page.can_edit)) or
|
||||
page.created_by==self.auth.user.id))
|
||||
def can_manage(self):
|
||||
if not self.auth.user: redirect(self.auth.settings.login_url)
|
||||
if not self.auth.user:
|
||||
return False
|
||||
groups = self.auth.user_groups.values()
|
||||
return 'wiki_editor' in groups
|
||||
def can_search(self):
|
||||
@@ -4610,11 +4611,11 @@ class Wiki(object):
|
||||
request = current.request
|
||||
automenu = self.menu(request.controller,request.function)
|
||||
current.response.menu += automenu
|
||||
zero = request.args(0)
|
||||
zero = request.args(0) or 'index'
|
||||
if zero and zero.isdigit():
|
||||
return self.media(int(zero))
|
||||
elif not zero or not zero.startswith('_'):
|
||||
return self.read(zero or 'index')
|
||||
return self.read(zero)
|
||||
elif zero=='_edit':
|
||||
return self.edit(request.args(1) or 'index')
|
||||
elif zero=='_editmedia':
|
||||
@@ -4648,19 +4649,20 @@ class Wiki(object):
|
||||
return body.replace('://HOSTNAME','://%s' % self.host)
|
||||
|
||||
def read(self,slug):
|
||||
if slug in '_cloud': return self.cloud()
|
||||
elif slug in '_search': return self.search()
|
||||
if slug in '_cloud':
|
||||
return self.cloud()
|
||||
elif slug in '_search':
|
||||
return self.search()
|
||||
page = self.auth.db.wiki_page(slug=slug)
|
||||
if not page:
|
||||
redirect(URL(args=('_create',slug)))
|
||||
if not self.can_read(page): return self.not_authorized(page)
|
||||
if not self.can_read(page):
|
||||
return self.not_authorized(page)
|
||||
if current.request.extension == 'html':
|
||||
if not page:
|
||||
url = URL(args=('_edit',slug))
|
||||
return dict(content=A('Create page "%s"' % slug,_href=url,_class="btn"))
|
||||
else:
|
||||
match = self.regex_redirect.match(page.body)
|
||||
if match: redirect(match.group(1))
|
||||
return dict(content=XML(self.fix_hostname(page.html)))
|
||||
elif current.request.extension == 'load':
|
||||
return self.fix_hostname(page.html) if page else ''
|
||||
@@ -4689,7 +4691,8 @@ class Wiki(object):
|
||||
if not self.can_edit(page): return self.not_authorized(page)
|
||||
title_guess = ' '.join(c.capitalize() for c in slug.split('-'))
|
||||
if not page:
|
||||
if not (self.can_manage() or slug.startswith(self.force_prefix)):
|
||||
if not (self.can_manage() or
|
||||
slug.startswith(self.force_prefix)):
|
||||
current.session.flash='slug must have "%s" prefix' \
|
||||
% self.force_prefix
|
||||
redirect(URL(args=('_edit',self.force_prefix+slug)))
|
||||
@@ -4743,7 +4746,8 @@ class Wiki(object):
|
||||
redirect(URL(args=('_edit',form.vars.slug)))
|
||||
return dict(content=form)
|
||||
def pages(self):
|
||||
if not self.can_manage(): return self.not_authorized()
|
||||
if not self.can_manage():
|
||||
return self.not_authorized()
|
||||
self.auth.db.wiki_page.id.represent = lambda id,row:SPAN('@////%s' % row.slug)
|
||||
self.auth.db.wiki_page.title.represent = lambda title,row: \
|
||||
A(title,_href=URL(args=row.slug))
|
||||
@@ -4826,6 +4830,7 @@ class Wiki(object):
|
||||
submenu.append((current.T('Search Pages'),None,
|
||||
URL(controller,function,args=('_search'))))
|
||||
return menu
|
||||
|
||||
def search(self,tags=None,query=None,cloud=True,preview=True,
|
||||
limitby=(0,100),orderby=None):
|
||||
if not self.can_search(): return self.not_authorized()
|
||||
|
||||
Reference in New Issue
Block a user