Skip to content

Commit

Permalink
Merge a148788 into e8b060d
Browse files Browse the repository at this point in the history
  • Loading branch information
@phochste
phochste committed Mar 5, 2020
2 parents e8b060d + a148788 commit e4ff930
Show file tree
Hide file tree
Showing 5 changed files with 68 additions and 18 deletions.
1 change: 1 addition & 0 deletions cpanfile
View file
Expand Up @@ -84,6 +84,7 @@ requires 'App::bmkpasswd', '2.010001';
requires 'Autoload::AUTOCAN', '0.005';
requires 'Business::ISBN10';
requires 'Business::ISBN13';
requires 'CHI','0.60';
requires 'Clone';
requires 'Code::TidyAll', 0;
requires 'Config::Onion', '>= 1.007';
Expand Down
65 changes: 57 additions & 8 deletions lib/LibreCat/App/Catalogue/Controller/Permission.pm
View file
Expand Up @@ -9,9 +9,42 @@ use LibreCat::Access;
use Carp;
use Dancer qw(:syntax);
use Exporter qw/import/;
use CHI;

use Moo;

sub cache {
state $cache = CHI->new(
driver => "Memory",
datastore => +{},
expires_in => h->config->{permissions}->{cache}->{expires_in} // 5,
);
}

sub get_cached_publication {
my $id = $_[0];

my $pub = cache()->get( "RECORD_${id}" );
my $set_cache = !$pub;
$pub //= h->main_publication->get($id);

cache()->set( "RECORD_${id}", $pub) if $set_cache;

$pub;
}

sub get_cached_user {
my $user_id = $_[0];

my $user = cache()->get( "USER_${user_id}" );
my $set_cache = !$user;
$user //= h->get_person( $user_id );

cache()->set("USER_${user_id}", $user) if $set_cache;

$user;
}

sub _can_do_action {
my ($self, $action, $id, $opts) = @_;

Expand All @@ -30,8 +63,11 @@ sub _can_do_action {

return 0 unless defined($user_id) && defined($role);

my $pub = publication->search_bag->get($id) or return 0;
my $user = h->get_person($user_id);
my $pub = $opts->{live} ? h->main_publication->get($id) : get_cached_publication($id);

is_hash_ref($pub) or return 0;

my $user = $opts->{live} ? h->get_person( $user_id ) : get_cached_user($user_id);

# do not touch deleted records
return 0 if $pub->{status} && $pub->{status} eq 'deleted';
Expand Down Expand Up @@ -69,7 +105,9 @@ Publication identifier
=item opts
Hash reference containing "user_id" and "role". Both must be a string
* user_id
* role
* [live=1]
=back
Expand All @@ -90,7 +128,9 @@ Publication identifier
=item opts
Hash reference containing "user_id" and "role". Both must be a string
* user_id
* role
* [live=1]
=back
Expand All @@ -111,7 +151,9 @@ Publication identifier
=item opts
Hash reference containing "user_id" and "role". Both must be a string
* user_id
* role
* [live=1]
=back
Expand All @@ -132,7 +174,9 @@ Publication identifier
=item opts
Hash reference containing "user_id" and "role". Both must be a string
* user_id
* role
* [live=1]
=back
Expand All @@ -153,7 +197,9 @@ Publication identifier
=item opts
Hash reference containing "user_id" and "role". Both must be a string
* user_id
* role
* [live=1]
=back
Expand All @@ -180,6 +226,7 @@ Hash reference containing:
* role (string)
* file_id (string)
* ip (string)
* [live=1]
=back
Expand All @@ -191,8 +238,10 @@ sub can_download {
is_string($id) or return (0, "");
is_hash_ref($opts) or return (0, "");

my $pub = publication->search_bag->get($id) or return (0, "");
my $pub = $opts->{live} ? h->main_publication->get($id) : get_cached_publication($id);

is_hash_ref($pub) or retur (0,"");

my $file_id = $opts->{file_id};
my $user_id = $opts->{user_id};
my $role = $opts->{role};
Expand Down
3 changes: 2 additions & 1 deletion lib/LibreCat/App/Catalogue/Route/file.pm
View file
Expand Up @@ -156,7 +156,8 @@ sub _handle_download {
file_id => $file_id,
user_id => session->{user_id},
role => session->{role},
ip => request->address
ip => request->address,
live => 1
}
);

Expand Down
16 changes: 8 additions & 8 deletions lib/LibreCat/App/Catalogue/Route/publication.pm
View file
Expand Up @@ -139,7 +139,7 @@ Checks if the user has permission the see/edit this record.
unless (
p->can_edit(
$rec->{_id},
{user_id => session("user_id"), role => session("role")}
{user_id => session("user_id"), role => session("role"), live=>1}
)
)
{
Expand Down Expand Up @@ -201,7 +201,7 @@ Checks if the user has the rights to update this record.
$params->{finalSubmit} eq 'recPublish'
&& p->can_make_public(
$params->{_id},
{user_id => session("user_id"), role => session("role")}
{user_id => session("user_id"), role => session("role"), live=>1}
)
)
{
Expand All @@ -211,7 +211,7 @@ Checks if the user has the rights to update this record.
$params->{finalSubmit} eq 'recReturn'
&& p->can_return(
$params->{_id},
{user_id => session("user_id"), role => session("role")}
{user_id => session("user_id"), role => session("role"), live=>1}
)
)
{
Expand All @@ -221,7 +221,7 @@ Checks if the user has the rights to update this record.
$params->{finalSubmit} eq 'recSubmit'
&& p->can_submit(
$params->{_id},
{user_id => session("user_id"), role => session("role")}
{user_id => session("user_id"), role => session("role"), live=>1}
)
)
{
Expand All @@ -230,7 +230,7 @@ Checks if the user has the rights to update this record.
elsif (
p->can_edit(
$params->{_id},
{user_id => session("user_id"), role => session("role")}
{user_id => session("user_id"), role => session("role"), live=>1}
)
)
{
Expand Down Expand Up @@ -352,7 +352,7 @@ Checks if the user has the rights to edit this record.
unless (
p->can_return(
$rec->{_id},
{user_id => session("user_id"), role => session("role")}
{user_id => session("user_id"), role => session("role"), live=>1}
)
)
{
Expand Down Expand Up @@ -390,7 +390,7 @@ Deletes record with id. For admins only.
unless (
p->can_delete(
$rec->{_id},
{user_id => session("user_id"), role => session("role")}
{user_id => session("user_id"), role => session("role"), live=>1}
)
)
{
Expand Down Expand Up @@ -518,7 +518,7 @@ Publishes private records, returns to the list.
unless (
p->can_make_public(
$rec->{_id},
{user_id => session("user_id"), role => session("role")}
{user_id => session("user_id"), role => session("role"), live=>1}
)
)
{
Expand Down
1 change: 0 additions & 1 deletion t/LibreCat/App/Catalogue/Route/file.t
View file
Expand Up @@ -159,7 +159,6 @@ note("hide record from public and try to download");
$pubs->search_bag->add($r);
$pubs->bag->commit();
$pubs->search_bag->commit;

$mech->max_redirect(0);
$mech->get("/download/$record_id/$file_id/$file_name");
is ($mech->status, 403, "forbidden: status 403");
Expand Down

0 comments on commit e4ff930

Please sign in to comment.