|
|
@@ -18,7 +18,7 @@ from django_tables2.export import TableExport
|
|
|
|
|
|
from extras.models import ExportTemplate
|
|
|
from utilities.error_handlers import handle_protectederror
|
|
|
-from utilities.exceptions import AbortTransaction
|
|
|
+from utilities.exceptions import AbortTransaction, PermissionsViolation
|
|
|
from utilities.forms import (
|
|
|
BootstrapMixin, BulkRenameForm, ConfirmationForm, CSVDataField, ImportForm, TableConfigForm, restrict_form_fields,
|
|
|
)
|
|
|
@@ -267,7 +267,8 @@ class ObjectEditView(GetReturnURLMixin, ObjectPermissionRequiredMixin, View):
|
|
|
obj = form.save()
|
|
|
|
|
|
# Check that the new object conforms with any assigned object-level permissions
|
|
|
- self.queryset.get(pk=obj.pk)
|
|
|
+ if not self.queryset.filter(pk=obj.pk).first():
|
|
|
+ raise PermissionsViolation()
|
|
|
|
|
|
msg = '{} {}'.format(
|
|
|
'Created' if object_created else 'Modified',
|
|
|
@@ -295,7 +296,7 @@ class ObjectEditView(GetReturnURLMixin, ObjectPermissionRequiredMixin, View):
|
|
|
else:
|
|
|
return redirect(self.get_return_url(request, obj))
|
|
|
|
|
|
- except ObjectDoesNotExist:
|
|
|
+ except PermissionsViolation:
|
|
|
msg = "Object save failed due to object-level permissions violation"
|
|
|
logger.debug(msg)
|
|
|
form.add_error(None, msg)
|
|
|
@@ -457,7 +458,7 @@ class BulkCreateView(GetReturnURLMixin, ObjectPermissionRequiredMixin, View):
|
|
|
|
|
|
# Enforce object-level permissions
|
|
|
if self.queryset.filter(pk__in=[obj.pk for obj in new_objs]).count() != len(new_objs):
|
|
|
- raise ObjectDoesNotExist
|
|
|
+ raise PermissionsViolation
|
|
|
|
|
|
# If we make it to this point, validation has succeeded on all new objects.
|
|
|
msg = "Added {} {}".format(len(new_objs), model._meta.verbose_name_plural)
|
|
|
@@ -471,7 +472,7 @@ class BulkCreateView(GetReturnURLMixin, ObjectPermissionRequiredMixin, View):
|
|
|
except IntegrityError:
|
|
|
pass
|
|
|
|
|
|
- except ObjectDoesNotExist:
|
|
|
+ except PermissionsViolation:
|
|
|
msg = "Object creation failed due to object-level permissions violation"
|
|
|
logger.debug(msg)
|
|
|
form.add_error(None, msg)
|
|
|
@@ -542,7 +543,8 @@ class ObjectImportView(GetReturnURLMixin, ObjectPermissionRequiredMixin, View):
|
|
|
obj = model_form.save()
|
|
|
|
|
|
# Enforce object-level permissions
|
|
|
- self.queryset.get(pk=obj.pk)
|
|
|
+ if not self.queryset.filter(pk=obj.pk).first():
|
|
|
+ raise PermissionsViolation()
|
|
|
|
|
|
logger.debug(f"Created {obj} (PK: {obj.pk})")
|
|
|
|
|
|
@@ -578,7 +580,7 @@ class ObjectImportView(GetReturnURLMixin, ObjectPermissionRequiredMixin, View):
|
|
|
except AbortTransaction:
|
|
|
pass
|
|
|
|
|
|
- except ObjectDoesNotExist:
|
|
|
+ except PermissionsViolation:
|
|
|
msg = "Object creation failed due to object-level permissions violation"
|
|
|
logger.debug(msg)
|
|
|
form.add_error(None, msg)
|
|
|
@@ -689,7 +691,7 @@ class BulkImportView(GetReturnURLMixin, ObjectPermissionRequiredMixin, View):
|
|
|
|
|
|
# Enforce object-level permissions
|
|
|
if self.queryset.filter(pk__in=[obj.pk for obj in new_objs]).count() != len(new_objs):
|
|
|
- raise ObjectDoesNotExist
|
|
|
+ raise PermissionsViolation
|
|
|
|
|
|
# Compile a table containing the imported objects
|
|
|
obj_table = self.table(new_objs)
|
|
|
@@ -707,7 +709,7 @@ class BulkImportView(GetReturnURLMixin, ObjectPermissionRequiredMixin, View):
|
|
|
except ValidationError:
|
|
|
pass
|
|
|
|
|
|
- except ObjectDoesNotExist:
|
|
|
+ except PermissionsViolation:
|
|
|
msg = "Object import failed due to object-level permissions violation"
|
|
|
logger.debug(msg)
|
|
|
form.add_error(None, msg)
|
|
|
@@ -822,7 +824,7 @@ class BulkEditView(GetReturnURLMixin, ObjectPermissionRequiredMixin, View):
|
|
|
|
|
|
# Enforce object-level permissions
|
|
|
if self.queryset.filter(pk__in=[obj.pk for obj in updated_objects]).count() != len(updated_objects):
|
|
|
- raise ObjectDoesNotExist
|
|
|
+ raise PermissionsViolation
|
|
|
|
|
|
if updated_objects:
|
|
|
msg = 'Updated {} {}'.format(len(updated_objects), model._meta.verbose_name_plural)
|
|
|
@@ -834,7 +836,7 @@ class BulkEditView(GetReturnURLMixin, ObjectPermissionRequiredMixin, View):
|
|
|
except ValidationError as e:
|
|
|
messages.error(self.request, "{} failed validation: {}".format(obj, e))
|
|
|
|
|
|
- except ObjectDoesNotExist:
|
|
|
+ except PermissionsViolation:
|
|
|
msg = "Object update failed due to object-level permissions violation"
|
|
|
logger.debug(msg)
|
|
|
form.add_error(None, msg)
|
|
|
@@ -929,7 +931,7 @@ class BulkRenameView(GetReturnURLMixin, ObjectPermissionRequiredMixin, View):
|
|
|
|
|
|
# Enforce constrained permissions
|
|
|
if self.queryset.filter(pk__in=renamed_pks).count() != len(selected_objects):
|
|
|
- raise ObjectDoesNotExist
|
|
|
+ raise PermissionsViolation
|
|
|
|
|
|
messages.success(request, "Renamed {} {}".format(
|
|
|
len(selected_objects),
|
|
|
@@ -937,7 +939,7 @@ class BulkRenameView(GetReturnURLMixin, ObjectPermissionRequiredMixin, View):
|
|
|
))
|
|
|
return redirect(self.get_return_url(request))
|
|
|
|
|
|
- except ObjectDoesNotExist:
|
|
|
+ except PermissionsViolation:
|
|
|
msg = "Object update failed due to object-level permissions violation"
|
|
|
logger.debug(msg)
|
|
|
form.add_error(None, msg)
|
|
|
@@ -1142,7 +1144,7 @@ class ComponentCreateView(GetReturnURLMixin, ObjectPermissionRequiredMixin, View
|
|
|
|
|
|
# Enforce object-level permissions
|
|
|
if self.queryset.filter(pk__in=[obj.pk for obj in new_objs]).count() != len(new_objs):
|
|
|
- raise ObjectDoesNotExist
|
|
|
+ raise PermissionsViolation
|
|
|
|
|
|
messages.success(request, "Added {} {}".format(
|
|
|
len(new_components), self.queryset.model._meta.verbose_name_plural
|
|
|
@@ -1150,7 +1152,7 @@ class ComponentCreateView(GetReturnURLMixin, ObjectPermissionRequiredMixin, View
|
|
|
# Return the newly created objects so overridden post methods can use the data as needed.
|
|
|
return new_objs
|
|
|
|
|
|
- except ObjectDoesNotExist:
|
|
|
+ except PermissionsViolation:
|
|
|
msg = "Component creation failed due to object-level permissions violation"
|
|
|
logger.debug(msg)
|
|
|
form.add_error(None, msg)
|
|
|
@@ -1227,12 +1229,12 @@ class BulkComponentCreateView(GetReturnURLMixin, ObjectPermissionRequiredMixin,
|
|
|
|
|
|
# Enforce object-level permissions
|
|
|
if self.queryset.filter(pk__in=[obj.pk for obj in new_components]).count() != len(new_components):
|
|
|
- raise ObjectDoesNotExist
|
|
|
+ raise PermissionsViolation
|
|
|
|
|
|
except IntegrityError:
|
|
|
pass
|
|
|
|
|
|
- except ObjectDoesNotExist:
|
|
|
+ except PermissionsViolation:
|
|
|
msg = "Component creation failed due to object-level permissions violation"
|
|
|
logger.debug(msg)
|
|
|
form.add_error(None, msg)
|