ag-admin/OpenSlides
0
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Merge pull request #2966 from emanuelschuetze/issue2956

Browse Source 
Send only data to client which user is allowed to see (Fixed #2956).
This commit is contained in:
Emanuel Schütze 2017-02-15 20:18:45 +01:00 committed by GitHub
commit be342f752f
2 changed files with 21 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
openslides/mediafiles/access_permissions.py
View File

@ -25,8 +25,8 @@ class MediafileAccessPermissions(BaseAccessPermissions):
Returns the restricted serialized data for the instance prepared Returns the restricted serialized data for the instance prepared
for the user. for the user.
""" """
if (not full_data['hidden'] or has_perm(user, 'mediafiles.can_see_hidden')): data = None
data = full_data if has_perm(user, 'mediafiles.can_see'):
else: if (not full_data['hidden'] or has_perm(user, 'mediafiles.can_see_hidden')):
data = None data = full_data
return data return data

34
openslides/motions/access_permissions.py
View File

@ -47,23 +47,23 @@ class MotionAccessPermissions(BaseAccessPermissions):
is_submitter = False is_submitter = False
required_permission_to_see = full_data['state_required_permission_to_see'] required_permission_to_see = full_data['state_required_permission_to_see']
if (not required_permission_to_see or data = None
has_perm(user, required_permission_to_see) or if has_perm(user, 'motions.can_see'):
has_perm(user, 'motions.can_manage') or if (not required_permission_to_see or
is_submitter): has_perm(user, required_permission_to_see) or
if has_perm(user, 'motions.can_see_and_manage_comments') or not full_data.get('comments'): has_perm(user, 'motions.can_manage') or
data = full_data is_submitter):
else: if has_perm(user, 'motions.can_see_and_manage_comments') or not full_data.get('comments'):
data = deepcopy(full_data) data = full_data
for i, field in enumerate(config['motions_comments']): else:
if not field.get('public'): data = deepcopy(full_data)
try: for i, field in enumerate(config['motions_comments']):
data['comments'][i] = None if not field.get('public'):
except IndexError: try:
# No data in range. Just do nothing. data['comments'][i] = None
pass except IndexError:
else: # No data in range. Just do nothing.
data = None pass
return data return data
def get_projector_data(self, full_data): def get_projector_data(self, full_data):