add show_for_users option

admin_tools_stats/migrations/0010_dashboardstats_show_to_users.py

@@ -0,0 +1,18 @@
+# Generated by Django 3.0.11 on 2021-01-22 16:04
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('admin_tools_stats', '0009_auto_20200928_1003'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='dashboardstats',
+            name='show_to_users',
+            field=models.BooleanField(default=False, help_text="Be carefull and test if it still doesn't expose sensitive data", verbose_name='show to ordinary users'),
+        ),
+    ]

admin_tools_stats/models.py

@@ -209,6 +209,12 @@ class DashboardStats(models.Model):
         null=True, blank=True,
         help_text=_("ex. owner, invitation__owner"),
     )
+    show_to_users = models.BooleanField(
+        verbose_name=_("show to ordinary users"),
+        null=False, blank=False,
+        default=False,
+        help_text=_("Be carefull and test if it still doesn't expose sensitive data"),
+    )
     operation_field_name = models.CharField(
         max_length=90, verbose_name=_("Operate field name"),
         null=True, blank=True,

admin_tools_stats/views.py

@@ -3,9 +3,7 @@
 from collections import OrderedDict
 from datetime import datetime
 
-from django.contrib.auth.decorators import user_passes_test
 from django.utils import timezone
-from django.utils.decorators import method_decorator
 from django.views.generic import TemplateView
 
 from .models import DashboardStats
@@ -41,11 +39,14 @@ def get_dateformat(interval, chart_type):
     return interval_dateformat_map[interval]
 
 
-@method_decorator(user_passes_test(lambda u: u.is_superuser), name='dispatch')
 class ChartDataView(TemplateView):
     template_name = 'admin_tools_stats/chart_data.html'
 
     def get_context_data(self, *args, interval=None, graph_key=None, **kwargs):
+        dashboard_stats = DashboardStats.objects.get(graph_key=graph_key)
+        if not(self.request.user.is_superuser or dashboard_stats.show_to_users):
+            self.handle_no_permission()
+
         context = super().get_context_data(*args, **kwargs)
         interval = self.request.GET.get('select_box_interval', interval)
         context['chart_type'] = self.request.GET.get('select_box_chart_type', interval)
@@ -55,8 +56,6 @@ def get_context_data(self, *args, interval=None, graph_key=None, **kwargs):
         except ValueError:
             return context
 
-        dashboard_stats = DashboardStats.objects.get(graph_key=graph_key)
-
         try:
             series = dashboard_stats.get_multi_time_series(self.request.GET, time_since, time_until, interval, self.request)
         except Exception as e:
@@ -122,5 +121,8 @@ class AnalyticsView(TemplateView):
 
     def get_context_data(self, *args, **kwargs):
         context_data = super().get_context_data(*args, **kwargs)
-        context_data['charts'] = DashboardStats.objects.all()
+        query = DashboardStats.objects.all()
+        if not self.request.user.is_superuser:
+            query = query.filter(show_to_users=True)
+        context_data['charts'] = query
         return context_data