zware/awx
1
0
Fork 0
mirror of https://github.com/ZwareBear/awx.git synced 2026-05-13 07:08:36 -05:00
Code Issues Packages Projects Releases Wiki Activity

add execution_environment_admin_role to the an organizations read role, which access.py uses for determining access to reading an ee within an organization,

Browse Source 
add migration file for execution_env_admin role addition to read_roles within an organization,

and set check related to mandatory
This commit is contained in:
Rebeccah
2021-02-18 17:24:17 -05:00
committed by Shane McDonald
parent eaa74b40c1
commit 41fb21911e
3 changed files with 25 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
awx/main/access.py
+3 -3
View File
@@ -1325,7 +1325,7 @@ class ExecutionEnvironmentAccess(BaseAccess):
def filtered_queryset(self):
return ExecutionEnvironment.objects.filter(
Q(organization__in=Organization.accessible_pk_qs(self.user, 'member_role')) |
Q(organization__in=Organization.accessible_pk_qs(self.user, 'read_role')) |
Q(organization__isnull=True)
).distinct()
@@ -1333,7 +1333,7 @@ class ExecutionEnvironmentAccess(BaseAccess):
def can_add(self, data):
if not data: # So the browseable API will work
return Organization.accessible_objects(self.user, 'execution_environment_admin_role').exists()
return self.check_related('organization', Organization, data)
return self.check_related('organization', Organization, data, mandatory=True)
@check_superuser
def can_change(self, obj, data):
@@ -1341,7 +1341,7 @@ class ExecutionEnvironmentAccess(BaseAccess):
raise PermissionDenied
if obj and obj.organization_id is None:
raise PermissionDenied
if self.user not in obj.organization.execution_environment_admin_role and self.user not in obj.organization.admin_role:
if self.user not in obj.organization.execution_environment_admin_role:
raise PermissionDenied
org_pk = get_pk_from_dict(data, 'organization')
if obj and obj.organization_id != org_pk: