diff --git a/ckan/logic/action/create.py b/ckan/logic/action/create.py index de39787f4dd..212c7d93121 100644 --- a/ckan/logic/action/create.py +++ b/ckan/logic/action/create.py @@ -703,6 +703,7 @@ def organization_create(context, data_dict): return _group_or_org_create(context, data_dict, is_org=True) +@logic.auth_audit_exempt def rating_create(context, data_dict): '''Rate a dataset (package). diff --git a/ckan/logic/action/get.py b/ckan/logic/action/get.py index 178313ad3c4..330d262738d 100644 --- a/ckan/logic/action/get.py +++ b/ckan/logic/action/get.py @@ -810,6 +810,8 @@ def resource_status_show(context, data_dict): return result_list + +@logic.auth_audit_exempt def revision_show(context, data_dict): '''Return the details of a revision. @@ -992,7 +994,7 @@ def user_show(context, data_dict): revisions_list = [] for revision in revisions_q.limit(20).all(): - revision_dict = revision_show(context,{'id':revision.id}) + revision_dict = logic.get_action('revision_show')(context,{'id':revision.id}) revision_dict['state'] = revision.state revisions_list.append(revision_dict) user_dict['activity'] = revisions_list @@ -1004,7 +1006,7 @@ def user_show(context, data_dict): for dataset in dataset_q: try: - dataset_dict = package_show(context, {'id': dataset.id}) + dataset_dict = logic.get_action('package_show')(context, {'id': dataset.id}) except logic.NotAuthorized: continue user_dict['datasets'].append(dataset_dict) @@ -2537,9 +2539,10 @@ def display_name(followee): # Get the followed objects. # TODO: Catch exceptions raised by these *_followee_list() functions? + # FIXME should we be changing the context like this it seems dangerous followee_dicts = [] context['skip_validation'] = True - context['skip_authorization'] = True + context['ignore_auth'] = True for followee_list_function, followee_type in ( (user_followee_list, 'user'), (dataset_followee_list, 'dataset'), @@ -2574,8 +2577,7 @@ def user_followee_list(context, data_dict): :rtype: list of dictionaries ''' - if not context.get('skip_authorization'): - _check_access('user_followee_list', context, data_dict) + _check_access('user_followee_list', context, data_dict) if not context.get('skip_validation'): schema = context.get('schema') or ( @@ -2605,8 +2607,7 @@ def dataset_followee_list(context, data_dict): :rtype: list of dictionaries ''' - if not context.get('skip_authorization'): - _check_access('dataset_followee_list', context, data_dict) + _check_access('dataset_followee_list', context, data_dict) if not context.get('skip_validation'): schema = context.get('schema') or ( @@ -2637,8 +2638,7 @@ def group_followee_list(context, data_dict): :rtype: list of dictionaries ''' - if not context.get('skip_authorization'): - _check_access('group_followee_list', context, data_dict) + _check_access('group_followee_list', context, data_dict) if not context.get('skip_validation'): schema = context.get('schema', diff --git a/ckan/logic/auth/get.py b/ckan/logic/auth/get.py index cc310ff3296..18bd1c3ea86 100644 --- a/ckan/logic/auth/get.py +++ b/ckan/logic/auth/get.py @@ -252,14 +252,17 @@ def followee_list(context, data_dict): return _followee_list(context, data_dict) +@logic.auth_audit_exempt def user_followee_list(context, data_dict): return _followee_list(context, data_dict) +@logic.auth_audit_exempt def dataset_followee_list(context, data_dict): return _followee_list(context, data_dict) +@logic.auth_audit_exempt def group_followee_list(context, data_dict): return _followee_list(context, data_dict)