diff --git a/config.sample.py b/config.sample.py index 9e1ec20..8d2027a 100644 --- a/config.sample.py +++ b/config.sample.py @@ -15,3 +15,8 @@ OIDC_ISSUER = 'https://sso.csh.rit.edu/auth/realms/csh' OIDC_CLIENT_ID = 'gallery' OIDC_CLIENT_SECRET = '' + +EBOARD_UIDS = '' +RTP_UIDS = '' +ORGANIZER_UIDS = '' +ALUMNI_UIDS = '' diff --git a/gallery/__init__.py b/gallery/__init__.py index 3f835c1..b3a8747 100644 --- a/gallery/__init__.py +++ b/gallery/__init__.py @@ -84,6 +84,8 @@ None, app.config.get("EBOARD_UIDS", "").split(","), app.config.get("RTP_UIDS", "").split(","), + app.config.get("ORGANIZER_UIDS", "").split(","), + app.config.get("ALUMNI_UIDS", "").split(","), ) app.add_template_global(ldap, name="ldap") @@ -571,6 +573,7 @@ def move_file(file_id: int, auth_dict: Optional[Dict[str, Any]] = None): assert auth_dict if not (auth_dict['is_eboard'] or auth_dict['is_rtp'] + or auth_dict['is_organizer'] or auth_dict['uuid'] == file_model.author): return "Permission denied", 403 @@ -597,6 +600,7 @@ def move_dir(dir_id: int, auth_dict: Optional[Dict[str, Any]] = None): assert auth_dict if not (auth_dict['is_eboard'] or auth_dict['is_rtp'] + or auth_dict['is_organizer'] or auth_dict['uuid'] == dir_model.author): return "Permission denied", 403 diff --git a/gallery/ldap.py b/gallery/ldap.py index 0a08d66..1549e4a 100644 --- a/gallery/ldap.py +++ b/gallery/ldap.py @@ -13,15 +13,21 @@ def is_member_of_group(member: CSHMember, group: str) -> bool: class LDAPWrapper(object): - def __init__(self, ldap: Optional[CSHLDAP], eboard: Optional[List[str]] = None, rtp: Optional[List[str]] = None): + def __init__(self, ldap: Optional[CSHLDAP], eboard: Optional[List[str]] = None, rtp: Optional[List[str]] = None, organizer: Optional[List[str]] = None, alumni: Optional[List[str]] = None): self._ldap = ldap self._eboard: List[str] = [] self._rtp: List[str] = [] + self._organizer: List[str] = [] + self._alumni: List[str] = [] if eboard: self._eboard = eboard if rtp: self._rtp = rtp + if organizer: + self._organizer = organizer + if alumni: + self._alumni = alumni def convert_uuid_to_displayname(self, uuid: str) -> str: if uuid == "root": @@ -38,17 +44,23 @@ def is_eboard(self, uid: str) -> bool: def is_rtp(self, uid: str) -> bool: if self._ldap is None: return uid in self._rtp - rtp_group = self._ldap.get_group('rtp') - return rtp_group.check_member(self._ldap.get_member(uid, uid=True)) + return is_member_of_group(self._ldap.get_member(uid, uid=True), 'rtp') def is_alumni(self, uid: str) -> bool: + if self._ldap is None: + return uid in self._alumni return not is_member_of_group(self._ldap.get_member(uid, uid=True), 'current_student') + def is_organizer(self, uid: str) -> bool: + if self._ldap is None: + return uid in self._organizer + return is_member_of_group(self._ldap.get_member(uid, uid=True), 'gallery_organizers') + + def get_members(self) -> List[Dict[str, str]]: if self._ldap is None: return [] con = self._ldap.get_con() - res = con.search_s( "dc=csh,dc=rit,dc=edu", pyldap.SCOPE_SUBTREE, diff --git a/gallery/templates/view_dir.html b/gallery/templates/view_dir.html index 840f687..75119a4 100644 --- a/gallery/templates/view_dir.html +++ b/gallery/templates/view_dir.html @@ -81,8 +81,10 @@