Added fine grained permission checks

.gitignore

@@ -4,4 +4,7 @@ dist
 *.egg-info
 *.pot
 .DS_store
-fabfile.py
+fabfile.py
+.settings/
+.project
+.pydevproject

AUTHORS

@@ -3,3 +3,4 @@ Axel Swoboda <[email protected]>
 Klemens Mantzos <[email protected]>
 Vaclav Mikolasek <[email protected]>
 Tim Graham <[email protected]>
+Antonio Angelino <[email protected]>

filebrowser/permissions.py

@@ -0,0 +1,25 @@
+from django.db import models
+from django.contrib.auth.models import Permission
+from django.contrib.contenttypes.models import ContentType
+
+
+class FileBrowserPermissionManager(models.Manager):
+    def get_queryset(self):
+        return super(FileBrowserPermissionManager, self).\
+            get_queryset().filter(content_type__name='filebrowser_permission')
+
+
+class FileBrowserPermission(Permission):
+    """Permission for the file browser, not attached to a model"""
+
+    objects = FileBrowserPermissionManager()
+
+    class Meta:
+        proxy = True
+
+    def save(self, *args, **kwargs):
+        ct, created = ContentType.objects.get_or_create(
+            name="filebrowser", app_label=self._meta.app_label
+        )
+        self.content_type = ct
+        super(FileBrowserPermission, self).save(*args, **kwargs)

filebrowser/sites.py

@@ -13,6 +13,7 @@
 from django.template import RequestContext as Context
 from django.http import HttpResponseRedirect, HttpResponseBadRequest
 from django.contrib.admin.views.decorators import staff_member_required
+from django.core.exceptions import PermissionDenied
 from django.views.decorators.cache import never_cache
 from django.utils.translation import ugettext as _
 from django import forms
@@ -283,6 +284,10 @@ def urls(self):
 
     def browse(self, request):
         "Browse Files/Directories."
+
+        if not request.user.has_perm('filebrowser.can_list_files'):
+            raise PermissionDenied
+
         filter_re = []
         for exp in EXCLUDE:
             filter_re.append(re.compile(exp))
@@ -360,6 +365,10 @@ def filter_browse(item):
 
     def createdir(self, request):
         "Create Directory"
+
+        if not request.user.has_perm('filebrowser.can_add_directories'):
+            raise PermissionDenied
+
         from filebrowser.forms import CreateDirForm
         query = request.GET
         path = u'%s' % os.path.join(self.directory, query.get('dir', ''))
@@ -396,6 +405,10 @@ def createdir(self, request):
 
     def upload(self, request):
         "Multipe File Upload."
+
+        if not request.user.has_perm('filebrowser.can_add_files'):
+            raise PermissionDenied
+
         query = request.GET
 
         return render_to_response('filebrowser/upload.html', {
@@ -409,6 +422,10 @@ def upload(self, request):
 
     def delete_confirm(self, request):
         "Delete existing File/Directory."
+
+        if not request.user.has_perm('filebrowser.can_delete_files'):
+            raise PermissionDenied
+
         query = request.GET
         path = u'%s' % os.path.join(self.directory, query.get('dir', ''))
         fileobject = FileObject(os.path.join(path, query.get('filename', '')), site=self)
@@ -442,6 +459,10 @@ def delete_confirm(self, request):
 
     def delete(self, request):
         "Delete existing File/Directory."
+
+        if not request.user.has_perm('filebrowser.can_delete_files'):
+            raise PermissionDenied
+
         query = request.GET
         path = u'%s' % os.path.join(self.directory, query.get('dir', ''))
         fileobject = FileObject(os.path.join(path, query.get('filename', '')), site=self)
@@ -464,6 +485,10 @@ def detail(self, request):
         Show detail page for a file.
         Rename existing File/Directory (deletes existing Image Versions/Thumbnails).
         """
+
+        if not request.user.has_perm('filebrowser.can_view_files'):
+            raise PermissionDenied
+
         from filebrowser.forms import ChangeForm
         query = request.GET
         path = u'%s' % os.path.join(self.directory, query.get('dir', ''))
@@ -477,19 +502,25 @@ def detail(self, request):
                 try:
                     action_response = None
                     if action_name:
+                        if not request.user.has_perm('filebrowser.can_edit_files'):
+                            raise PermissionDenied
                         action = self.get_action(action_name)
                         # Pre-action signal
                         signals.filebrowser_actions_pre_apply.send(sender=request, action_name=action_name, fileobject=[fileobject], site=self)
                         # Call the action to action
                         action_response = action(request=request, fileobjects=[fileobject])
                         # Post-action signal
                         signals.filebrowser_actions_post_apply.send(sender=request, action_name=action_name, fileobject=[fileobject], result=action_response, site=self)
+
                     if new_name != fileobject.filename:
+                        if not request.user.has_perm('filebrowser.can_rename_files'):
+                            raise PermissionDenied
                         signals.filebrowser_pre_rename.send(sender=request, path=fileobject.path, name=fileobject.filename, new_name=new_name, site=self)
                         fileobject.delete_versions()
                         self.storage.move(fileobject.path, os.path.join(fileobject.head, new_name))
                         signals.filebrowser_post_rename.send(sender=request, path=fileobject.path, name=fileobject.filename, new_name=new_name, site=self)
                         messages.add_message(request, messages.SUCCESS, _('Renaming was successful.'))
+
                     if isinstance(action_response, HttpResponse):
                         return action_response
                     if "_continue" in request.POST:
@@ -594,3 +625,18 @@ def _upload_file(self, request):
 site.add_action(rotate_90_clockwise)
 site.add_action(rotate_90_counterclockwise)
 site.add_action(rotate_180)
+
+#Load default permissions
+from filebrowser.permissions import FileBrowserPermission
+from django.db.utils import IntegrityError
+try:
+    FileBrowserPermission.objects.create(codename="can_list_files", name="Can List Files") #OK
+    FileBrowserPermission.objects.create(codename="can_view_files", name="Can View Files") #OK
+    FileBrowserPermission.objects.create(codename="can_add_files", name="Can Add Files") #OK
+    FileBrowserPermission.objects.create(codename="can_edit_files", name="Can Edit Files") #OK
+    FileBrowserPermission.objects.create(codename="can_rename_files", name="Can Rename Files") #OK
+    FileBrowserPermission.objects.create(codename="can_delete_files", name="Can Delete Files") #OK
+    FileBrowserPermission.objects.create(codename="can_add_directories", name="Can Add Directories") #OK
+except IntegrityError:
+    #Ok, they are still there!
+    pass