From: Michael Tremer <michael.tremer@ipfire.org>
Date: Thu, 6 Oct 2022 10:06:21 +0000 (+0000)
Subject: mirrors: Introduce permissions model
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=1e32a1516d2861be7ca4a7e4544239ee1a98d0af;p=pbs.git

mirrors: Introduce permissions model

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
---

diff --git a/src/buildservice/mirrors.py b/src/buildservice/mirrors.py
index 42ab43ae..d51fb2b3 100644
--- a/src/buildservice/mirrors.py
+++ b/src/buildservice/mirrors.py
@@ -149,6 +149,14 @@ class Mirror(base.DataObject):
 
 	deleted = property(lambda s: s.data.deleted, set_deleted)
 
+	def has_perm(self, user):
+		# Anonymous users have no permission
+		if not user:
+			return False
+
+		# Admins have all permissions
+		return user.is_admin()
+
 	@property
 	def path(self):
 		return self.data.path
diff --git a/src/templates/mirrors/detail.html b/src/templates/mirrors/detail.html
index 8ab65dfc..072feb59 100644
--- a/src/templates/mirrors/detail.html
+++ b/src/templates/mirrors/detail.html
@@ -25,7 +25,7 @@
 				<small class="text-muted">{{ mirror.owner }}</small>
 			</h2>
 		</div>
-		{% if current_user and current_user.has_perm("manage_mirrors") %}
+		{% if mirror.has_perm(current_user) %}
 			<div class="col-12 col-sm-12 col-md-3 col-lg-2 col-xl-2">
 				<button class="btn dropdown-toggle btn-block " type="button" id="dropdownMenuButton" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false">
 					{{ _("Actions") }}
@@ -62,7 +62,7 @@
 							<td class="text-muted">{{ _("The location of the mirror server could not be estimated.") }}</td>
 						</tr>
 
-						{% if current_user and current_user.has_perm("manage_mirrors") %}
+						{% if mirror.has_perm(current_user) %}
 							<tr>
 								<td>{{ _("Contact") }}</td>
 								<td>
diff --git a/src/templates/mirrors/list.html b/src/templates/mirrors/list.html
index 33c89659..a9a51492 100644
--- a/src/templates/mirrors/list.html
+++ b/src/templates/mirrors/list.html
@@ -18,7 +18,7 @@
 		<div class="col-12 col-sm-12 col-md-3 col-lg-10 col-xl-10">
 			<h2>{{ _("Mirrors") }}</h2>
 		</div>
-		{% if current_user and current_user.has_perm("manage_mirrors") %}
+		{% if current_user and current_user.is_admin() %}
 			<div class="col-12 col-sm-12 col-md-3 col-lg-2 col-xl-2">
 				<button class="btn dropdown-toggle btn-block" type="button" id="dropdownMenuButton" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false">
 					{{ _("Actions") }}
diff --git a/src/web/mirrors.py b/src/web/mirrors.py
index b4f1aecc..570b8bec 100644
--- a/src/web/mirrors.py
+++ b/src/web/mirrors.py
@@ -2,8 +2,6 @@
 
 import tornado.web
 
-from .. import mirrors
-
 from . import base
 
 class MirrorListHandler(base.BaseHandler):
@@ -23,18 +21,9 @@ class MirrorDetailHandler(base.BaseHandler):
 		self.render("mirrors/detail.html", mirror=mirror, log=log)
 
 
-class MirrorActionHandler(base.BaseHandler):
-	"""
-		A handler that makes sure if the user has got sufficent rights to
-		do actions.
-	"""
-	def prepare(self):
-		# Check if the user has sufficient rights to create a new mirror.
-		if not self.current_user.has_perm("manage_mirrors"):
-			raise tornado.web.HTTPError(403)
-
+class MirrorNewHandler(base.BaseHandler):
+	# XXX everyone can perform this task because of a lacking permission check
 
-class MirrorNewHandler(MirrorActionHandler):
 	@tornado.web.authenticated
 	def get(self, hostname="", path="", hostname_missing=False, path_invalid=False):
 		self.render("mirrors/new.html", _hostname=hostname, path=path,
@@ -66,13 +55,17 @@ class MirrorNewHandler(MirrorActionHandler):
 		self.redirect("/mirror/%s" % mirror.hostname)
 
 
-class MirrorEditHandler(MirrorActionHandler):
+class MirrorEditHandler(base.BaseHandler):
 	@tornado.web.authenticated
 	def get(self, hostname):
 		mirror = self.backend.mirrors.get_by_hostname(hostname)
 		if not mirror:
 			raise tornado.web.HTTPError(404, "Could not find mirror: %s" % hostname)
 
+		# Check permissions
+		if not mirror.has_perm(self.current_user):
+			raise tornado.web.HTTPError(403)
+
 		self.render("mirrors/edit.html", mirror=mirror)
 
 	@tornado.web.authenticated
@@ -81,6 +74,10 @@ class MirrorEditHandler(MirrorActionHandler):
 		if not mirror:
 			raise tornado.web.HTTPError(404, "Could not find mirror: %s" % hostname)
 
+		# Check permissions
+		if not mirror.has_perm(self.current_user):
+			raise tornado.web.HTTPError(403)
+
 		with self.db.transaction():
 			mirror.hostname       = self.get_argument("name")
 			mirror.path           = self.get_argument("path", "")
@@ -91,14 +88,18 @@ class MirrorEditHandler(MirrorActionHandler):
 		self.redirect("/mirror/%s" % mirror.hostname)
 
 
-class MirrorDeleteHandler(MirrorActionHandler):
+class MirrorDeleteHandler(base.BaseHandler):
 	@tornado.web.authenticated
 	def get(self, hostname):
 		mirror = self.backend.mirrors.get_by_hostname(hostname)
 		if not mirror:
 			raise tornado.web.HTTPError(404, "Could not find mirror: %s" % hostname)
 
-		confirmed = self.get_argument("confirmed", None)	
+		# Check permissions
+		if not mirror.has_perm(self.current_user):
+			raise tornado.web.HTTPError(403)
+
+		confirmed = self.get_argument("confirmed", None)
 		if confirmed:
 			with self.db.transaction():
 				mirror.deleted = True