django-viewflow 2.3.0__tar.gz → 2.3.1__tar.gz

{django_viewflow-2.3.0/django_viewflow.egg-info → django_viewflow-2.3.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: django-viewflow
-Version: 2.3.0
+Version: 2.3.1
 Summary: Reusable library to build business applications fast
 Author: Mikhail Podgurskiy
 Author-email: kmmbvnr@gmail.com

{django_viewflow-2.3.0 → django_viewflow-2.3.1/django_viewflow.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: django-viewflow
-Version: 2.3.0
+Version: 2.3.1
 Summary: Reusable library to build business applications fast
 Author: Mikhail Podgurskiy
 Author-email: kmmbvnr@gmail.com

{django_viewflow-2.3.0 → django_viewflow-2.3.1}/setup.py

@@ -4,7 +4,7 @@ README = open("README.md", "r", encoding="utf-8").read()
 
 setuptools.setup(
     name="django-viewflow",
-    version="2.3.0",
+    version="2.3.1",
     author_email="kmmbvnr@gmail.com",
     author="Mikhail Podgurskiy",
     description="Reusable library to build business applications fast",

{django_viewflow-2.3.0 → django_viewflow-2.3.1}/viewflow/__init__.py

@@ -13,7 +13,7 @@ from .this_object import this
 from .utils import viewprop, Icon, DEFAULT
 
 __title__ = "Django-Viewflow"
-__version__ = "2.3.0"
+__version__ = "2.3.1"
 __author__ = "Mikhail Podgurskiy"
 __license__ = "AGPL"
 __copyright__ = "Copyright 2018-2021 Mikhail Podgurskiy"

{django_viewflow-2.3.0 → django_viewflow-2.3.1}/viewflow/workflow/flow/utils.py

@@ -2,6 +2,7 @@ from functools import update_wrapper
 
 from django.core.exceptions import ImproperlyConfigured, PermissionDenied
 from django.db import transaction
+from django.http import Http404
 from django.shortcuts import get_object_or_404
 from viewflow.fsm import TransitionNotAllowed
 
@@ -18,6 +19,12 @@ def wrap_task_view(self, origin_view, permission=None):
 
         def call_with_activation():
             task = get_object_or_404(self.flow_class.task_class, pk=task_pk)
+            # The task_class is the shared Task table, so a task from any flow
+            # is reachable by pk. Confirm it belongs to this flow, otherwise the
+            # permission below would be evaluated against the URL's flow rather
+            # than the task's own flow (cross-flow access).
+            if task.process.flow_class != self.flow_class:
+                raise Http404("No task matches the given query.")
             request.activation = self.activation_class(task)
 
             if permission and not permission(request.user, task=task):
@@ -69,6 +76,8 @@ def wrap_view(flow_task, origin_view):
 
         def call_with_activation():
             task = get_object_or_404(flow_task.flow_class.task_class, pk=task_pk)
+            if task.process.flow_class != flow_task.flow_class:
+                raise Http404("No task matches the given query.")
             request.activation = flow_task.activation_class(task)
 
             if not flow_task.can_execute(request.user, task=task):

{django_viewflow-2.3.0 → django_viewflow-2.3.1}/viewflow/workflow/flow/views/actions.py

@@ -200,9 +200,19 @@ class BulkUnassignTasksActionView(BaseBulkActionView):
     template_name_suffix = "s_unassign"
 
     def form_valid(self, form):
+        user = self.request.user
         with transaction.atomic():
             for task in self.get_queryset():
                 with task.activation() as activation:
+                    # The queryset is the unscoped Task table filtered by the
+                    # submitted pks, and activation.unassign() does not enforce
+                    # its declared permission. Re-check per task against the
+                    # task's own flow node, exactly as the single-task view does.
+                    can_unassign = getattr(task.flow_task, "can_unassign", None)
+                    if not callable(can_unassign) or not can_unassign(
+                        user, activation.task
+                    ):
+                        raise PermissionDenied
                     activation.unassign()
         self.message_user()
         return HttpResponseRedirect(self.get_success_url())
@@ -220,10 +230,20 @@ class BulkAssignTasksActionView(BaseBulkActionView):
     template_name_suffix = "s_assign"
 
     def form_valid(self, form):
+        user = self.request.user
         with transaction.atomic():
             for task in self.get_queryset():
                 with task.activation() as activation:
-                    activation.assign(self.request.user)
+                    # The queryset is the unscoped Task table filtered by the
+                    # submitted pks, and activation.assign() does not enforce
+                    # its declared permission. Re-check per task against the
+                    # task's own flow node, exactly as the single-task view does.
+                    can_assign = getattr(task.flow_task, "can_assign", None)
+                    if not callable(can_assign) or not can_assign(
+                        user, activation.task
+                    ):
+                        raise PermissionDenied
+                    activation.assign(user)
         self.message_user()
         return HttpResponseRedirect(self.get_success_url())