TheDude
/
openproject
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

move project allowed query to authorization

Browse Source
pull/4778/head
Jens Ulferts 8 years ago
parent a0c7658c18
commit 8a8dfdd3de
3 changed files with 126 additions and 60 deletions
Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL
Show Stats Download Patch File Download Diff File
  1. 61
      app/models/project.rb
  2. 4
      app/services/authorization.rb
  3. 121
      app/services/authorization/project_query.rb

61
app/models/project.rb
Unescape View File

@ -340,67 +340,8 @@ class Project < ActiveRecord::Base
.references(:projects)
end
# Returns a SQL conditions string used to find all projects for which +user+ has the given +permission+
#
# Valid options:
# * project: limit the condition to project
# * with_subprojects: limit the condition to project and its subprojects
# * member: limit the condition to the user projects
# * project_alias: the alias to use for the project's table - default: 'projects'
def self.allowed_to_condition(user, permission, options = {})
table_alias = options.fetch(:project_alias, Project.table_name)
base_statement = "#{table_alias}.status=#{Project::STATUS_ACTIVE}"
if perm = Redmine::AccessControl.permission(permission)
unless perm.project_module.nil?
# If the permission belongs to a project module, make sure the module is enabled
enabled_module_statement = "SELECT em.project_id FROM #{EnabledModule.table_name} em"
if options[:project] && options[:with_subprojects]
enabled_module_statement << " JOIN #{table_alias} ON #{table_alias}.id = em.project_id"
end
enabled_module_statement << " WHERE em.name='#{perm.project_module}'"
if options[:project]
project_statement = "em.project_id = #{options[:project].id}"
project_statement << " OR (#{table_alias}.lft > #{options[:project].lft} AND #{table_alias}.rgt < #{options[:project].rgt})" if options[:with_subprojects]
enabled_module_statement << " AND (#{project_statement})"
end
base_statement << " AND #{table_alias}.id IN (#{enabled_module_statement})"
end
end
if options[:project]
project_statement = "#{table_alias}.id = #{options[:project].id}"
project_statement << " OR (#{table_alias}.lft > #{options[:project].lft} AND #{table_alias}.rgt < #{options[:project].rgt})" if options[:with_subprojects]
base_statement = "(#{project_statement}) AND (#{base_statement})"
end
if user.admin?
base_statement
else
statement_by_role = {}
if user.logged?
if Role.non_member.allowed_to?(permission) && !options[:member]
statement_by_role[Role.non_member] = "#{table_alias}.is_public = #{connection.quoted_true}"
end
user.projects_by_role.each do |role, projects|
if role.allowed_to?(permission)
statement_by_role[role] = "#{table_alias}.id IN (#{projects.map(&:id).join(',')})"
end
end
else
if Role.anonymous.allowed_to?(permission) && !options[:member]
statement_by_role[Role.anonymous] = "#{table_alias}.is_public = #{connection.quoted_true}"
end
end
if statement_by_role.empty?
'1=0'
else
"((#{base_statement}) AND (#{statement_by_role.values.join(' OR ')}))"
end
end
Authorization::ProjectQuery.query(user, permission, options)
end
# Returns the Systemwide and project specific activities

4
app/services/authorization.rb
Unescape View File

@ -32,6 +32,10 @@ class Authorization
Authorization::UserAllowedQuery.query(action, project)
end
def self.projects(action, user)
Authorization::ProjectQuery.query(user, action)
end
def self.roles(user, project = nil)
if project
Authorization::UserProjectRolesQuery.query(user, project)

121
app/services/authorization/project_query.rb
Unescape View File

@ -0,0 +1,121 @@
#-- encoding: UTF-8
#-- copyright
# OpenProject is a project management system.
# Copyright (C) 2012-2015 the OpenProject Foundation (OPF)
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of the GNU General Public License version 3.
#
# OpenProject is a fork of ChiliProject, which is a fork of Redmine. The copyright follows:
# Copyright (C) 2006-2013 Jean-Philippe Lang
# Copyright (C) 2010-2013 the ChiliProject Team
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of the GNU General Public License
# as published by the Free Software Foundation; either version 2
# of the License, or (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
#
# See doc/COPYRIGHT.rdoc for more details.
#++
class Authorization::ProjectQuery
# Returns a SQL conditions string used to find all projects for which +user+
# has the given +permission+
#
# Valid options:
# * project: limit the condition to project
# * with_subprojects: limit the condition to project and its subprojects
# * member: limit the condition to the user projects
# * project_alias: the alias to use for the project's table - default: 'projects'
def self.query(user, permission, options = {})
table_alias = options.fetch(:project_alias, Project.table_name)
base_statement = "#{table_alias}.status=#{Project::STATUS_ACTIVE}"
if perm = Redmine::AccessControl.permission(permission)
unless perm.project_module.nil?
# If the permission belongs to a project module, make sure the module is enabled
module_query = enabled_module_query(perm.project_module,
options[:project],
options[:with_subproject])
base_statement << " AND #{table_alias}.id IN (#{module_query})"
end
end
if options[:project]
project_statement = "#{table_alias}.id = #{options[:project].id}"
if options[:with_subprojects]
project_statement << " OR (#{descendants_condition(options[:project], table_alias)})"
end
base_statement = "(#{project_statement}) AND (#{base_statement})"
end
if user.admin?
base_statement
else
statement_by_role = {}
if user.logged?
if Role.non_member.allowed_to?(permission) && !options[:member]
non_member_statements = [public_project_condition(table_alias)]
member_project_ids = user.memberships.map(&:project_id)
unless member_project_ids.empty?
non_member_statements << "#{table_alias}.id NOT IN (#{member_project_ids.join(', ')})"
end
statement_by_role[Role.non_member] = non_member_statements.join(" AND ")
end
user.projects_by_role.each do |role, projects|
if role.allowed_to?(permission)
statement_by_role[role] = "#{table_alias}.id IN (#{projects.map(&:id).join(',')})"
end
end
elsif Role.anonymous.allowed_to?(permission) && !options[:member]
statement_by_role[Role.anonymous] = public_project_condition(table_alias)
end
if statement_by_role.empty?
'1=0'
else
"((#{base_statement}) AND (#{statement_by_role.values.join(' OR ')}))"
end
end
end
def self.enabled_module_query(project_module, project, with_subprojects)
enabled_module_statement = "SELECT em.project_id FROM #{EnabledModule.table_name} em"
if project && with_subprojects
enabled_module_statement << " JOIN #{table_alias} ON #{table_alias}.id = em.project_id"
end
enabled_module_statement << " WHERE em.name='#{project_module}'"
if project
project_statement = "em.project_id = #{project.id}"
if with_subprojects
project_statement << " OR (#{descendants_condition(project, table_alias)})"
end
enabled_module_statement << " AND (#{project_statement})"
end
enabled_module_statement
end
def self.descendants_condition(project, table_alias)
"#{table_alias}.lft > #{project.lft} AND #{table_alias}.rgt < #{project.rgt}"
end
def self.public_project_condition(table_alias)
"#{table_alias}.is_public = #{Project.connection.quoted_true}"
end
end
Write Preview
Loading…
Cancel
Save