Commit cba3ad6b authored by Staś Kycia's avatar Staś Kycia
Browse files

permission fixes

parent 1475f130

elections/admin.py

+6 −6
Changes for elections/admin.py: 6 added lines, 6 removed lines.
Original line number Diff line number Diff line
@@ -33,13 +33,13 @@ class ElectionContributorInline(admin.TabularInline): 
            if obj is None:

                return

            

            if form.instance.user_id == obj.owner.id or request.user.is_superuser:

            if request.user == obj.owner.id or request.user.is_superuser:

                return

            elif form.instance.user_id == request.user.id:

                for field_name in form.fields:

                    form.fields[field_name].disabled = True

            else:

                form.fields["can_manage_permissions"].disabled = True

            # else:

                # form.fields["can_manage_permissions"].disabled = True

                

        formset.form.__init__ = new_init

        return formset
@@ -47,21 +47,21 @@ class ElectionContributorInline(admin.TabularInline): 
    def has_add_permission(self, request, obj=None):

        if obj is None:

            return super().has_add_permission(request, obj)

        if obj.owner == request.user:

        if obj.owner == request.user or request.user.is_superuser:

            return True

        return ElectionContributor.objects.filter(election=obj, user=request.user, can_manage_permissions=True).exists()

        

    def has_change_permission(self, request, obj=None):

        if obj is None:

            return super().has_change_permission(request, obj)

        if obj.owner == request.user:

        if obj.owner == request.user or request.user.is_superuser:

            return True

        return ElectionContributor.objects.filter(election=obj, user_id=request.user.id, can_manage_permissions=True).exists()

    

    def has_delete_permission(self, request, obj = None):

        if obj is None:

            return super().has_delete_permission(request, obj)

        if obj.owner == request.user:

        if obj.owner == request.user or request.user.is_superuser:

            return True

        return ElectionContributor.objects.filter(election=obj, user_id=request.user.id, can_manage_permissions=True).exists()

elections/models.py

+1 −1
Changes for elections/models.py: 1 added line, 1 removed line.
Original line number Diff line number Diff line
@@ -99,7 +99,7 @@ class ElectionContributor(models.Model): 
    can_view = models.BooleanField(default=True, verbose_name="wyświetlanie")

    can_edit = models.BooleanField(default=False, verbose_name="edycja")

    can_delete = models.BooleanField(default=False, verbose_name="usuwanie")

    can_manage_permissions = models.BooleanField(default=False, verbose_name="zarządzanie uprawnieniami")

    can_manage_permissions = models.BooleanField(default=False, verbose_name="zarządzanie uprawnieniami", help_text="Wymaga uprawnień do edycji")

    can_view_stats = models.BooleanField(default=False, verbose_name="przeglądanie wyników")

    can_issue_cards = models.BooleanField(default=False, verbose_name="wydawanie kart")

    can_enter_local_votes = models.BooleanField(default=False, verbose_name="wprowadzanie głosów stacjonarnych")

hybrid/admin.py

+2 −0
Changes for hybrid/admin.py: 2 added lines, 0 removed lines.
Original line number Diff line number Diff line
@@ -143,7 +143,9 @@ class IssueCardAdmin(admin.ModelAdmin): 
        return render(request, 'admin/issue_card_confirmation.html', context)

    

    def has_module_permission(self, request):

        if request.user.is_authenticated and (request.user.is_superuser or Election.objects.filter(owner=request.user).exists() or ElectionContributor.objects.filter(user=request.user, can_issue_cards=True)):

            return True

        return False

    

    def has_view_permission(self, request, obj = None):

        return True