[#6941] Check commit activity access against original tool if possible.
Signed-off-by: Tim Van Steenburgh <tvansteenburgh@gmail.com>
diff --git a/Allura/allura/model/discuss.py b/Allura/allura/model/discuss.py
index df55ac9..7b4f306 100644
--- a/Allura/allura/model/discuss.py
+++ b/Allura/allura/model/discuss.py
@@ -476,7 +476,7 @@
def activity_name(self):
return 'a comment'
- def has_activity_access(self, perm, user):
+ def has_activity_access(self, perm, user, activity):
"""Return True if user has perm access to this object, otherwise
return False.
diff --git a/Allura/allura/model/repo.py b/Allura/allura/model/repo.py
index 1ff6641..4a5d1ef 100644
--- a/Allura/allura/model/repo.py
+++ b/Allura/allura/model/repo.py
@@ -37,8 +37,10 @@
from allura.lib import utils
from allura.lib import helpers as h
+from allura.lib.security import has_access
from .auth import User
+from .project import AppConfig, Project
from .session import main_doc_session, project_doc_session
from .session import repository_orm_session
from .timeline import ActivityObject
@@ -174,10 +176,25 @@
def activity_name(self):
return self.shorthand_id()
- def has_activity_access(self, perm, user):
+ @property
+ def activity_extras(self):
+ d = ActivityObject.activity_extras.fget(self)
+ d.update(summary=self.summary)
+ if self.repo:
+ d.update(app_config_id=self.repo.app.config._id)
+ return d
+
+ def has_activity_access(self, perm, user, activity):
"""Commits have no ACLs and are therefore always viewable by any user.
"""
+ app_config_id = activity.obj.activity_extras.get('app_config_id')
+ if app_config_id:
+ app_config = AppConfig.query.get(_id=app_config_id)
+ if app_config:
+ project = Project.query.get(_id=app_config.project_id)
+ app = app_config.load()(project, app_config)
+ return has_access(app, perm, user, project)
return True
def set_context(self, repo):
diff --git a/Allura/allura/model/timeline.py b/Allura/allura/model/timeline.py
index a80e5ba..b45118e 100644
--- a/Allura/allura/model/timeline.py
+++ b/Allura/allura/model/timeline.py
@@ -51,7 +51,7 @@
"""
return "%s:%s" % (self.__class__.__name__, self._id)
- def has_activity_access(self, perm, user):
+ def has_activity_access(self, perm, user, activity):
"""Return True if user has perm access to this object, otherwise
return False.
"""
@@ -74,5 +74,5 @@
except bson.errors.InvalidId:
pass
obj = cls.query.get(_id=_id)
- return obj and obj.has_activity_access('read', user)
+ return obj and obj.has_activity_access('read', user, activity)
return _perm_check
