From 101131858b646e8e407ad888f1ea33bc111ddaad Mon Sep 17 00:00:00 2001 From: Ross Date: Thu, 22 Apr 2021 20:20:44 +0100 Subject: [PATCH] . --- generic/views.py | 38 ++++++++++++++++++++++++++++++-------- longs/filters.py | 14 +++++++++++++- rapids/filters.py | 6 ++++++ rapids/views.py | 8 ++++++++ 4 files changed, 57 insertions(+), 9 deletions(-) diff --git a/generic/views.py b/generic/views.py index 0f9db5bb..58a0deb3 100644 --- a/generic/views.py +++ b/generic/views.py @@ -198,8 +198,13 @@ class ExamViews(View, LoginRequiredMixin): @method_decorator(login_required) def exam_list(self, request): - if not request.user.groups.filter(name='rapid_checker').exists(): - raise PermissionDenied + if request.user not in exam.author.all(): + if self.app_name == "rapids" and not request.user.groups.filter(name='rapid_checker').exists(): + raise PermissionDenied + if self.app_name == "anatomy" and not request.user.groups.filter(name='anatomy_checker').exists(): + raise PermissionDenied + if self.app_name == "longs" and not request.user.groups.filter(name='longs_checker').exists(): + raise PermissionDenied exams = self.Exam.objects.all() return render(request, "{}/exam_list.html".format(self.app_name), {"exams": exams}) @@ -211,8 +216,13 @@ class ExamViews(View, LoginRequiredMixin): #print("test", Exam.objects.all().get(id=pk)) exam = get_object_or_404(self.Exam, pk=pk) - if self.app_name == "rapids" and request.user not in exam.author.all() and not request.user.groups.filter(name='rapid_checker').exists(): - raise PermissionDenied + if request.user not in exam.author.all(): + if self.app_name == "rapids" and not request.user.groups.filter(name='rapid_checker').exists(): + raise PermissionDenied + if self.app_name == "anatomy" and not request.user.groups.filter(name='anatomy_checker').exists(): + raise PermissionDenied + if self.app_name == "longs" and not request.user.groups.filter(name='longs_checker').exists(): + raise PermissionDenied questions = exam.exam_questions.all() @@ -280,8 +290,14 @@ class ExamViews(View, LoginRequiredMixin): def mark_overview(self, request, pk): exam = get_object_or_404(self.Exam, pk=pk) - if request.user not in exam.author.all() and not request.user.groups.filter(name='rapid_checker').exists(): - raise PermissionDenied + if request.user not in exam.author.all(): + if self.app_name == "rapids" and not request.user.groups.filter(name='rapid_checker').exists(): + raise PermissionDenied + if self.app_name == "anatomy" and not request.user.groups.filter(name='anatomy_checker').exists(): + raise PermissionDenied + if self.app_name == "longs" and not request.user.groups.filter(name='longs_checker').exists(): + raise PermissionDenied + questions = exam.exam_questions.all() @@ -302,8 +318,14 @@ class ExamViews(View, LoginRequiredMixin): def exam_question_detail(self, request, pk, sk): exam = get_object_or_404(self.Exam, pk=pk) - if request.user not in exam.author.all() and not request.user.groups.filter(name='rapid_checker').exists(): - raise PermissionDenied + if request.user not in exam.author.all(): + if self.app_name == "rapids" and not request.user.groups.filter(name='rapid_checker').exists(): + raise PermissionDenied + if self.app_name == "anatomy" and not request.user.groups.filter(name='anatomy_checker').exists(): + raise PermissionDenied + if self.app_name == "longs" and not request.user.groups.filter(name='longs_checker').exists(): + raise PermissionDenied + question = exam.exam_questions.all()[sk] diff --git a/longs/filters.py b/longs/filters.py index 7f6212b6..b7b8dedf 100755 --- a/longs/filters.py +++ b/longs/filters.py @@ -9,7 +9,19 @@ class LongFilter(django_filters.FilterSet): fields = (#"site", "created_date", "exams", "author") + def __init__(self, data=None, queryset=None, prefix=None, strict=None, user=None, request=None): + if not request.user.groups.filter(name="longs_checker").exists(): + queryset = queryset.filter(open_access=True) | queryset.filter(author__id=request.user.id) + super(LongFilter, self).__init__(data=data, queryset=queryset, prefix=prefix, request=request) + pass + class LongSeriesFilter(django_filters.FilterSet): class Meta: model = LongSeries - fields = ("modality","long", "examination", "author") \ No newline at end of file + fields = ("modality","long", "examination", "author") + + def __init__(self, data=None, queryset=None, prefix=None, strict=None, user=None, request=None): + if not request.user.groups.filter(name="longs_checker").exists(): + queryset = queryset.filter(open_access=True) | queryset.filter(author__id=request.user.id) + super(LongSeriesFilter, self).__init__(data=data, queryset=queryset, prefix=prefix, request=request) + pass \ No newline at end of file diff --git a/rapids/filters.py b/rapids/filters.py index 724a2260..3f3cc13c 100755 --- a/rapids/filters.py +++ b/rapids/filters.py @@ -10,3 +10,9 @@ class RapidFilter(django_filters.FilterSet): "laterality", #"site", "created_date", "author") + + def __init__(self, data=None, queryset=None, prefix=None, strict=None, user=None, request=None): + if not request.user.groups.filter(name="rapid_checker").exists(): + queryset = queryset.filter(open_access=True) | queryset.filter(author__id=request.user.id) + super(RapidFilter, self).__init__(data=data, queryset=queryset, prefix=prefix, request=request) + pass \ No newline at end of file diff --git a/rapids/views.py b/rapids/views.py index a2a85062..5d77e394 100755 --- a/rapids/views.py +++ b/rapids/views.py @@ -91,6 +91,8 @@ class AuthorOrCheckerRequiredMixin(object): def question_detail(request, pk): rapid = get_object_or_404(Rapid, pk=pk) + if not request.user.groups.filter(name="rapid_checker").exists() and request.user not in question.author.all(): + raise PermissionDenied() # if request.user not in rapid.author.all(): # raise PermissionDenied @@ -103,6 +105,9 @@ def question_detail(request, pk): def rapid_split(request, pk): rapid = get_object_or_404(Rapid, pk=pk) + if not request.user.groups.filter(name="rapid_checker").exists() and request.user not in question.author.all(): + raise PermissionDenied() + images = rapid.images.all() old_abnormality = rapid.abnormality.all() @@ -420,6 +425,9 @@ def rapid_scrap(request, pk): except Rapid.DoesNotExist: raise Http404("Rapid does not exist") + if not request.user.groups.filter(name="rapid_checker").exists() and request.user not in question.author.all(): + raise PermissionDenied() + rapid.scrapped = not rapid.scrapped rapid.save() return HttpResponseRedirect(reverse("rapids:question_detail", args=(pk,)))