wiki: Enforce ACLs for watchers

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

diff --git a/src/backend/wiki.py b/src/backend/wiki.py
index 9e5878c61507adc1c6c34e57900ea5b80b9c520e..51aa2b26a26cb42080a840dee0239620371a1e8f 100644 (file)
--- a/src/backend/wiki.py
+++ b/src/backend/wiki.py
@@ -525,6 +525,11 @@ class Page(misc.Object):
                                logging.debug("Excluding %s" % watcher)
                                continue
 
+                       # Check permissions
+                       if not self.backend.wiki.check_acl(self.page, watcher):
+                               logging.debug("Watcher %s does not have permissions" % watcher)
+                               continue
+
                        logging.debug("Sending watcher email to %s" % watcher)
 
                        # Compose message

diff --git a/src/web/wiki.py b/src/web/wiki.py
index e127a37d3a1a66b134c3ad68fc6bb811095aeba5..5a37ea22d80c972d348fec551f4b4ac5c0e85e26 100644 (file)
--- a/src/web/wiki.py
+++ b/src/web/wiki.py
@@ -91,6 +91,10 @@ class ActionWatchHandler(auth.CacheMixin, base.BaseHandler):
                if not page:
                        raise tornado.web.HTTPError(404, "Page does not exist: %s" % path)
 
+               # Check permissions
+               if not self.backend.wiki.check_acl(path, self.current_user):
+                       raise tornado.web.HTTPError(403, "Access to %s not allowed for %s" % (path, self.current_user))
+
                with self.db.transaction():
                        if action == "watch":
                                page.add_watcher(self.current_user)