0001-manager-prevent-changing-ldap-sychronised-role-affec.patch

Valentin Deniaud, 18 novembre 2019 16:56

Voir les différences: en ligne côte à côte

Subject: [PATCH] manager: prevent changing ldap-sychronised role affectations
 (#37187)

 src/authentic2/manager/role_views.py          |  5 ++++
 src/authentic2/manager/tables.py              |  4 ++-
 .../authentic2/manager/user_roles_table.html  |  6 ++++-
 src/authentic2/manager/user_views.py          | 15 +++++++++--
 tests/test_ldap.py                            | 26 +++++++++++++++++++
 5 files changed, 52 insertions(+), 4 deletions(-)

     import json
     from django.conf import settings
     from django.core.exceptions import PermissionDenied
     from django.utils.translation import ugettext_lazy as _
     from django.views.generic import FormView, TemplateView
-...
             ctx['admin_roles'] = views.filter_view(self.request,
                                                    self.object.get_admin_role().children(include_self=False,
                                                                                          annotate=True))
             mappings = getattr(settings, 'LDAP_AUTH_SETTINGS', [{}])[0].get('group_to_role_mapping', [])
             if mappings:
                 ctx['from_ldap'] = any(role for mapping in mappings for role in mapping[1]
                                        if role == self.object.name)
             return ctx
     members = RoleMembersView.as_view()

             'indeterminate{%% endif %%}"'
             ' name="role-{{ record.pk }}" type="checkbox" {%% if record.member %%}checked{%% endif %%} '
             '{%% if not record.has_perm %%}disabled '
             'title="{%% trans "%s" %%}"{%% endif %%}/>' % ugettext_noop('You are not authorized to manage this role'),
             'title="{%% trans "%s" %%}"{%% endif %%} '
             '{%% if record.from_ldap %%}disabled '
             'title="{%% trans "%s" %%}"{%% endif %%}/>' % (ugettext_noop('You are not authorized to manage this role'), ugettext_noop('This role is synchronised from LDAP, modification is not allowed.')),
             verbose_name=_('Member'),
             order_by=('member', 'via', 'name'))

         <th></th>
       {% endblock %}
       {% block table.tbody.last.column %}
       <td>{% if table.context.view.can_change and row.record.member %}<a class="icon-remove-sign js-remove-object" data-confirm="{% blocktrans with name=row.record.name username=table.context.object.get_full_name %}Do you really want to remove role &quot;{{ name }}&quot; from user &quot;{{ username }}&quot;&nbsp;?{% endblocktrans %}" href="#" data-pk-arg="role"></a>{% endif %}</td>
       <td>
         {% if table.context.view.can_change and row.record.member %}
           <a class="icon-remove-sign {% if row.record.from_ldap %} disabled {% else %} js-remove-object {% endif %}" data-confirm="{% blocktrans with name=row.record.name username=table.context.object.get_full_name %}Do you really want to remove role &quot;{{ name }}&quot; from user &quot;{{ username }}&quot;&nbsp;?{% endblocktrans %}" href="#" data-pk-arg="role" title="{% if row.record.from_ldap %}{% trans "This role is synchronised from LDAP, modification is not allowed." %}{% endif %}"></a>
         {% endif %}
       </td>
       {% endblock %}
     {% endif %}

     import collections
     import operator
     from django.conf import settings
     from django.db import models
     from django.utils.translation import ugettext_lazy as _, ugettext
     from django.utils.html import format_html
-...
                 manageable_ids = map(str, qs2.values_list('pk', flat=True))
                 qs = qs.extra(select={'has_perm': 'a2_rbac_role.id in (%s)' % ', '.join(manageable_ids)})
                 qs = qs.exclude(slug__startswith='_a2-managers-of-role')
                 return qs
             else:
                 return self.object.roles_and_parents()
                 qs = self.object.roles_and_parents()
             qs = self.indicate_ldap_roles(qs)
             return qs
         def indicate_ldap_roles(self, qs):
             mappings = getattr(settings, 'LDAP_AUTH_SETTINGS', [{}])[0].get('group_to_role_mapping', [])
             if mappings:
                 role_names = [role for mapping in mappings for role in mapping[1]]
                 roles = qs.filter(name__in=role_names)
                 role_ids = map(str, roles.values_list('pk', flat=True))
                 qs = qs.extra(select={'from_ldap': 'a2_rbac_role.id in (%s)' % ', '.join(role_ids)})
             return qs
         def get_table_data(self):
             qs = super(UserRolesView, self).get_table_data()

         assert response.context['user'].roles.count() == 1
     def test_group_to_role_mapping_modify_disabled(slapd, settings, db, app, admin, simple_user):
         from authentic2.a2_rbac.models import Role
         role = Role.objects.get_or_create(name='Role2', ou=simple_user.ou)[0]
         simple_user.roles.add(role)
         settings.LDAP_AUTH_SETTINGS = [{
             'url': [slapd.ldap_url],
             'basedn': u'o=ôrga',
             'use_tls': False,
             'group_to_role_mapping': [
                 ['cn=group2,o=ôrga', ['Role2']],
             ],
         }]
         utils.login(app, admin, '/manage/')
         response = app.get('/manage/users/%s/roles/?search-ou=all' % simple_user.pk)
         q = response.pyquery.remove_namespaces()
         assert q('table tbody td.name').text() == 'Role2'
         assert q('table tbody td .disabled')
         response = app.get('/manage/users/%s/roles/?search-ou=%s' % (simple_user.pk, simple_user.ou.pk))
         q = response.pyquery.remove_namespaces()
         assert q('table tbody td.name').text() == 'Role2'
         assert q('table tbody td.member input').attr('disabled')
     def test_group_su(slapd, settings, client, db):
         from django.contrib.auth.models import Group
+    -

Projet

Général

Profil

Produits Entr'ouvert » Authentic 2

0001-manager-prevent-changing-ldap-sychronised-role-affec.patch