alberanid/eventman
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

fixes 169: ability to grant super cow powers to users

Browse source
This commit is contained in:
Davide Alberani 2017-04-03 21:39:26 +02:00
parent fd3c3111a2
commit 0c231432a2
4 changed files with 26 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
angular_app/js/app.js vendored
View file

@ -75,16 +75,19 @@ eventManApp.run(['$rootScope', '$state', '$stateParams', '$log', 'Info',
} }
}; };
/* Check GUI privileges. */ /* Check privileges of the currently logged in user or of the one specified with the second parameter. */
$rootScope.hasPermission = function(permission) { $rootScope.hasPermission = function(permission, user) {
if (!($rootScope.info && $rootScope.info.user && $rootScope.info.user.permissions)) { if (!(user || ($rootScope.info && $rootScope.info.user && $rootScope.info.user.permissions))) {
return false; return false;
} }
if (!user) {
user = $rootScope.info.user;
}
var granted = false; var granted = false;
var splitted_permission = permission.split('|'); var splitted_permission = permission.split('|');
var global_permission = splitted_permission[0] + '|all'; var global_permission = splitted_permission[0] + '|all';
angular.forEach($rootScope.info.user.permissions || [], angular.forEach(user.permissions || [],
function(value, idx) { function(value, idx) {
if (value === 'admin|all' || value === global_permission || value === permission) { if (value === 'admin|all' || value === global_permission || value === permission) {
granted = true; granted = true;

1
angular_app/js/controllers.js vendored
View file

@ -687,6 +687,7 @@ eventManControllers.controller('UsersCtrl', ['$scope', '$rootScope', '$state', '
if ($state.is('user.edit') && $state.params.id) { if ($state.is('user.edit') && $state.params.id) {
$scope.user = User.get({id: $state.params.id}, function() { $scope.user = User.get({id: $state.params.id}, function() {
$scope.updateUserInfo = $scope.user; $scope.updateUserInfo = $scope.user;
$scope.updateUserInfo.isAdmin = $rootScope.hasPermission('admin|all', $scope.updateUserInfo);
}); });
} }

5
angular_app/user-edit.html
View file

@ -20,6 +20,11 @@
<span class="input-group-addon min150">{{'New password' | translate}}</span> <span class="input-group-addon min150">{{'New password' | translate}}</span>
<input type="password" id="new-password" name="new-password" ng-model="updateUserInfo.new_password" class="form-control"> <input type="password" id="new-password" name="new-password" ng-model="updateUserInfo.new_password" class="form-control">
</div> </div>
<div class="checkbox">
<label>
<input type="checkbox" ng-model="updateUserInfo.isAdmin"> Check me out
</label>
</div>
<button type="submit" ng-click="updateUser()" class="btn btn-success top10">{{'update' | translate}}</button> <button type="submit" ng-click="updateUser()" class="btn btn-success top10">{{'update' | translate}}</button>
</form> </form>
</div> </div>

17
eventman_server.py
View file

@ -909,9 +909,18 @@ class UsersHandler(CollectionHandler):
del data['_id'] del data['_id']
if 'username' in data: if 'username' in data:
del data['username'] del data['username']
# for the moment, prevent the ability to update permissions via web if not self.has_permission('admin|all'):
if 'permissions' in data: if 'permissions' in data:
del data['permissions'] del data['permissions']
else:
if 'isAdmin' in data:
if not 'permissions' in data:
data['permissions'] = []
if 'admin|all' in data['permissions'] and not data['isAdmin']:
data['permissions'].remove('admin|all')
elif 'admin|all' not in data['permissions'] and data['isAdmin']:
data['permissions'].append('admin|all')
del data['isAdmin']
return data return data
@gen.coroutine @gen.coroutine
@ -1197,7 +1206,7 @@ def run():
ws_application = tornado.web.Application([_ws_handler], debug=options.debug) ws_application = tornado.web.Application([_ws_handler], debug=options.debug)
ws_http_server = tornado.httpserver.HTTPServer(ws_application) ws_http_server = tornado.httpserver.HTTPServer(ws_application)
ws_http_server.listen(options.port+1, address='127.0.0.1') ws_http_server.listen(options.port+1, address='127.0.0.1')
logger.debug('Starting WebSocket on %s://127.0.0.1:%d', 'wss' if ssl_options else 'ws', options.port+1) logger.debug('Starting WebSocket on ws://127.0.0.1:%d', options.port+1)
tornado.ioloop.IOLoop.instance().start() tornado.ioloop.IOLoop.instance().start()