qm-acts-as-generic-controller 0.1.16 → 0.1.17

data/Rakefile

@@ -10,7 +10,7 @@ begin
     gemspec.email = "marcin@saepia.net"
     gemspec.homepage = "http://q.saepia.net"
     gemspec.authors = ["Marcin Lewandowski"]
-    gemspec.version = "0.1.16"
+    gemspec.version = "0.1.17"
     gemspec.files = Rake::FileList.new [ "MIT-LICENSE", "Rakefile", "lib/*", "app/views/generic_controller/*" ]
     gemspec.add_dependency "qui-common-helpers", ">= 0.0.8"
     gemspec.add_dependency "qui-index-table", ">= 0.0.8"

data/app/views/generic_controller/show.erb

@@ -48,7 +48,7 @@
 <%- tab_headers = {} -%>
 <%- record.class.generic_field_associations.each do |k,v| -%>
   <%- if current_user.respond_to? "has_privileges?" -%>
-    <%- has_privileges = current_user.has_privileges?(:class_name => v[:class_name], :generic_action => :index_any) -%>
+    <%- has_privileges = current_user.has_privileges?(:class_name => v[:class_name], :generic_action => :index_any) || current_user.has_privileges?(:class_name => v[:class_name], :generic_action => :index_created)-%>
     <%- has_privileges_to_generic_create = current_user.has_privileges?(:class_name => v[:class_name], :generic_action => :create) -%>
   <%- else -%>
     <%- has_privileges = true -%>
@@ -63,14 +63,8 @@
 
       <%- end -%>
     
-      <%- if v[:class_name].respond_to? :limit_for_user -%>
-        <%- tab_headers[k] = t(:"#{section_prefix}tabs.#{table_name}.#{k}") + " (#{record.send(k).limit_for_user(current_user).count})" %>
-        <%= render :partial => "generic_controller/index_table", :locals => { :records => record.send(k).limit_for_user(current_user), :class_name => v[:class_name] } %>
-
-      <%- else -%>
-        <%- tab_headers[k] = t(:"#{section_prefix}tabs.#{table_name}.#{k}") + " (#{record.send(k).count})" %>
-        <%= render :partial => "generic_controller/index_table", :locals => { :records => record.send(k), :class_name => v[:class_name] } %>
-      <%- end -%>
+      <%- tab_headers[k] = t(:"#{section_prefix}tabs.#{table_name}.#{k}") + " (#{record.send(k).limit_with_security_scheme(:user => current_user).size})" %>
+      <%= render :partial => "generic_controller/index_table", :locals => { :records => record.send(k).limit_with_security_scheme(:user => current_user), :class_name => v[:class_name] } %>
 
     <%- end -%>
   <%- end -%>

data/lib/qm-acts-as-generic-controller-controller.rb

@@ -36,38 +36,14 @@ module QM
       module InstanceMethods
         def index
           unless instance_variable_defined?(plural_variable)
-            if params[:scopes] and params[:scopes].is_a?(Array)
-              valid_scopes = params[:scopes].uniq.each{ |scope| scope if model.generic_named_scopes.has_key? scope.to_sym }.compact
-              if valid_scopes.size > 0
-                if defined?(current_user) and model.respond_to? :limit_for_user
-                  data = eval "model.#{valid_scopes.join(".")}.limit_for_user(#{current_user})"
-                else
-                  data = eval "model.#{valid_scopes.join(".")}"
-                end
-              else
-                if defined?(current_user) and model.respond_to? :limit_for_user
-                  data = model.limit_for_user(current_user)
-                else
-                  data = model.all
-                end
-              end
-            else
-              if defined?(current_user) and model.respond_to? :limit_for_user
-                data = model.limit_for_user(current_user)
-              else
-                data = model.all
-              end
-            end
-
-            
-            instance_variable_set(plural_variable, data) 
+            instance_variable_set(plural_variable, model.limit_with_security_scheme(:user => current_user)) 
           end
           
           respond_to do |format|
             format.html
             format.xml { 
               if defined?(current_user) and current_user.respond_to? :privileged_attributes
-                render :xml => instance_variable_get(plural_variable).to_xml(:only => current_user.privileged_attributes(model, :read, true) + [:id])
+                render :xml => instance_variable_get(plural_variable).to_xml(:only => current_user_xml_privileged_attributes)
               else
                 render :xml => instance_variable_get(plural_variable) 
               end
@@ -76,15 +52,16 @@ module QM
         end
 
         def show
-          
           instance_variable_set(singular_variable, model.find(params[:id])) unless instance_variable_defined?(singular_variable)
 
+          check_generic_actions or return
+
           respond_to do |format|
-            format.html
+            format.html 
 
             format.xml { 
               if defined?(current_user) and current_user.respond_to? :privileged_attributes
-                render :xml => instance_variable_get(singular_variable).to_xml(:only => current_user.privileged_attributes(model, :read, true) + [:id])
+                render :xml => instance_variable_get(singular_variable).to_xml(:only => current_user_xml_privileged_attributes)
               else
                 render :xml => instance_variable_get(singular_variable)
               end
@@ -94,6 +71,8 @@ module QM
 
         def edit
           instance_variable_set(singular_variable, model.find(params[:id])) unless instance_variable_defined?(singular_variable)
+
+          check_generic_actions or return
         end
         
         def new
@@ -103,7 +82,7 @@ module QM
             format.html
             format.xml { 
               if defined?(current_user) and current_user.respond_to? :privileged_attributes
-                render :xml => instance_variable_get(singular_variable).to_xml(:only => current_user.privileged_attributes(model, :read, true) + [:id])
+                render :xml => instance_variable_get(singular_variable).to_xml(:only => current_user_xml_privileged_attributes)
               else
                 render :xml => instance_variable_get(singular_variable)
               end
@@ -137,7 +116,7 @@ module QM
                   end
                 }
                 
-                format.xml  { render :xml => instance_variable_get(singular_variable).to_xml(:only => current_user.privileged_attributes(model, :read, true) + [:id]), :status => :created, :location => [ section, instance_variable_get(singular_variable) ] }
+                format.xml  { render :xml => instance_variable_get(singular_variable).to_xml(:only => current_user_xml_privileged_attributes), :status => :created, :location => [ section, instance_variable_get(singular_variable) ] }
 
 
               else
@@ -157,9 +136,9 @@ module QM
                 
                 format.xml { 
                   if defined?(current_user) and current_user.respond_to? :privileged_attributes
-                    render :xml => instance_variable_get(singular_variable).to_xml(:only => current_user.privileged_attributes(model, :read, true) + [:id]), :status => :created, :location => instance_variable_get(singular_variable)
+                    render :xml => instance_variable_get(singular_variable).to_xml(:only => current_user_xml_privileged_attributes), :status => :created, :location => instance_variable_get(singular_variable)
                   else
-                    render :xml => instance_variable_get(singular_variable).to_xml(:only => current_user.privileged_attributes(model, :read, true) + [:id]), :status => :created, :location => instance_variable_get(singular_variable)
+                    render :xml => instance_variable_get(singular_variable).to_xml(:only => current_user_xml_privileged_attributes), :status => :created, :location => instance_variable_get(singular_variable)
                   end
                 }
               end
@@ -174,7 +153,7 @@ module QM
               } 
               format.xml { 
                 if defined?(current_user) and current_user.respond_to? :privileged_attributes
-                  render :xml => instance_variable_get(singular_variable).to_xml(:only => current_user.privileged_attributes(model, :read, true) + [:id]), :status => :unprocessable_entity
+                  render :xml => instance_variable_get(singular_variable).to_xml(:only => current_user_xml_privileged_attributes), :status => :unprocessable_entity
                 else
                   render :xml => instance_variable_get(singular_variable), :status => :unprocessable_entity
                 end
@@ -186,6 +165,8 @@ module QM
         def update
           instance_variable_set(singular_variable, model.find(params[:id])) unless instance_variable_defined?(singular_variable)
 
+          check_generic_actions or return
+
           remove_unprivileged_keys_from_params
 
           instance_variable_get(singular_variable).update_attributes params[singular_variable(true)]
@@ -212,7 +193,7 @@ module QM
               } 
               format.xml { 
                 if defined?(current_user) and current_user.respond_to? :privileged_attributes
-                  render :xml => instance_variable_get(singular_variable).to_xml(:only => current_user.privileged_attributes(model, :read, true) + [:id]), :status => :unprocessable_entity
+                  render :xml => instance_variable_get(singular_variable).to_xml(:only => current_user_xml_privileged_attributes), :status => :unprocessable_entity
                 else
                   render :xml => instance_variable_get(singular_variable), :status => :unprocessable_entity
                 end
@@ -223,6 +204,9 @@ module QM
 
         def destroy
           instance_variable_set(singular_variable, model.find(params[:id])) unless instance_variable_defined?(singular_variable)
+
+          check_generic_actions or return
+
           instance_variable_get(singular_variable).destroy
 
           flash[:notice] = :destroyedAsFlash
@@ -235,11 +219,11 @@ module QM
         
         protected
           def save_creator
-            instance_variable_get(singular_variable).send("creator_#{current_user.class.to_s.tableize.singularize}_id=", current_user.id) if defined?(current_user) and instance_variable_get(singular_variable).respond_to? "creator_#{current_user.class.to_s.tableize.singularize}_id="
+            instance_variable_get(singular_variable).send("#{creator_column}=", current_user.id) if defined?(current_user) and instance_variable_get(singular_variable).respond_to? "#{creator_column}="
           end
 
           def save_updator
-            instance_variable_get(singular_variable).send("updator_#{current_user.class.to_s.tableize.singularize}_id=", current_user.id) if defined?(current_user) and instance_variable_get(singular_variable).respond_to? "updator_#{current_user.class.to_s.tableize.singularize}_id="
+            instance_variable_get(singular_variable).send("#{updator_column}=", current_user.id) if defined?(current_user) and instance_variable_get(singular_variable).respond_to? "#{updator_column}="
           end
           
           def model
@@ -255,6 +239,29 @@ module QM
           end
           
           
+          def check_generic_actions
+            if has_creator?
+              action = case params[:action].to_sym
+                when :show
+                  :show_created
+                when :edit
+                  :update_created
+                when :update
+                  :update_created
+                when :destroy
+                  :delete_created
+              end
+              
+              if not current_user.has_privileges?({:class_name => model, :generic_action => "#{params[:action]}_any".to_sym}) and current_user.has_privileges?({:class_name => model, :generic_action => action.to_sym}) and instance_variable_get(singular_variable).send(creator_column) != current_user.id 
+
+                logger.warn "Security warning: User #{current_user.login} has #{action} privileges, but there is a creator's ID mismatch (current user: #{current_user.id}, record: #{instance_variable_get(singular_variable).send(creator_column)}. Action #{params[:action]} on #{model} was stopped."
+                render_generic_forbidden
+                return false
+              end
+            end
+            true
+          end
+          
           def check_generic_privileges
             return true unless defined?(current_user)
             return true unless current_user.respond_to? "has_privileges?"
@@ -262,24 +269,38 @@ module QM
             action = params[:action].to_sym
             action = case action
               when :index
-                :index_any
+                [ :index_any, :index_created ] # Limited access to the elements should be provided by limit_for_user, which (TODO) should be automatically generated
               when :show
-                :show_any
+                [ :show_any, :show_created ]
               when :edit
-                :update_any
+                [ :update_any, :update_created ]
               when :update
-                :update_any
+                [ :update_any, :update_created ]
               when :create
                 :create
               when :destroy
-                :delete_any
+                [ :delete_any, :delete_created ]
             end
             
-            unless current_user.has_privileges? :class_name => model, :action => action
-              logger.info "Security warning: User #{current_user.login} has not enough privileges to perform action #{action} on #{model}"
+            if action.is_a? Array
+              has_privileges = false
+              action.each do |a|
+                if current_user.has_privileges? :class_name => model, :generic_action => a
+                  has_privileges = true
+                  break 
+                end
+              end
+            else
+              has_privileges = current_user.has_privileges? :class_name => model, :generic_action => action
+            end
+
+            unless has_privileges
+              logger.warn "Security warning: User #{current_user.login} has not enough privileges to perform action #{params[:action]} on #{model}"
               render_generic_forbidden
+              return false
             end
             
+            true
           end
           
           def check_limit_for_user
@@ -290,14 +311,32 @@ module QM
             if defined?(current_user) and current_user.respond_to? :privileged_attributes
               params[singular_variable(true)].keys.each do |key|
                 if not current_user.privileged_attributes(model, :write).include?(key) and (model.generic_field_associations.has_key?(key.to_sym) and not current_user.privileged_attributes(model, :write).include?(model.generic_field_associations[key.to_sym][:foreign_key]))
-                  logger.info "Security warning: Deleting key '#{key}' from params hash, because user #{current_user.login} has not enough privileges to modify that attribute"
+                  logger.warn "Security warning: Deleting key '#{key}' from params hash, because user #{current_user.login} has not enough privileges to modify that attribute"
                   params[singular_variable(true)].delete key 
                 end
               end
             end
           end
           
+          def current_user_xml_privileged_attributes
+            current_user.privileged_attributes(model, :read, true) + [:id]
+          end
           
+          def creator_column
+            "creator_#{current_user.class.to_s.tableize.singularize}_id"
+          end
+          
+          def has_creator?
+            model.columns_hash.has_key? creator_column
+          end
+
+          def updator_column
+            "updator_#{current_user.class.to_s.tableize.singularize}_id"
+          end
+          
+          def has_updator?
+            model.columns_hash.has_key? updator_column
+          end
           
           def render_generic_forbidden
             # FIXME TODO render something more nice to user

data/lib/qm-acts-as-generic-controller-model.rb

@@ -3,10 +3,36 @@ module QM
     module ModelIncludes
       def self.included(base) # :nodoc:
         base.extend ClassMethods
-
       end
 
       module ClassMethods
+        def limit_with_security_scheme(options)
+          # options[:user] - current user that performs the query
+          
+          raise ArgumentError, "You must pass options[:user] to limit_with_security_scheme" unless options.has_key? :user
+
+          # Return empty set if user has no privileges at all (nor index_any and index_created)
+          return [] if !options[:user].has_privileges?(:class_name => self, :generic_action => :index_any) && !options[:user].has_privileges?(:class_name => self, :generic_action => :index_created)
+          
+          creator_column = "creator_#{options[:user].class.to_s.tableize.singularize}_id"
+          should_limit_index_for_created = columns_hash.has_key?(creator_column) && options[:user].respond_to?(:has_privileges?) && !options[:user].has_privileges?(:class_name => self, :generic_action => :index_any) && options[:user].has_privileges?(:class_name => self, :generic_action => :index_created)
+          
+          
+          if respond_to? :limit_for_user
+            if should_limit_index_for_created
+              limit_for_user(options[:user]).find(:all, :conditions => { creator_column => options[:user].id })
+            else
+              limit_for_user(options[:user])
+            end
+          else
+            if should_limit_index_for_created
+              find(:all, :conditions => { creator_column => options[:user].id })
+            else
+              all
+            end
+          end          
+        end
+
         def generic_field_associations
           @generic_field_associations || {}
         end
@@ -62,8 +88,6 @@ module QM
           
           super name, options, &block
         end
-      
-      
 
         def generic_actions(options = {})
           @generic_actions ||= {}  

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification 
 name: qm-acts-as-generic-controller
 version: !ruby/object:Gem::Version 
-  hash: 59
+  hash: 57
   prerelease: false
   segments: 
   - 0
   - 1
-  - 16
-  version: 0.1.16
+  - 17
+  version: 0.1.17
 platform: ruby
 authors: 
 - Marcin Lewandowski
@@ -15,7 +15,7 @@ autorequire:
 bindir: bin
 cert_chain: []
 
-date: 2011-01-07 00:00:00 +01:00
+date: 2011-01-10 00:00:00 +01:00
 default_executable: 
 dependencies: 
 - !ruby/object:Gem::Dependency