fix a few major permission holes

atlas/views.py

@@ -99,12 +99,11 @@ from autocomplete import HTMXAutoComplete
 
 from .decorators import (
     user_is_author_or_atlas_editor,
-    user_is_author_or_atlas_editor_or_atlas_marker,
+    user_has_case_view_access,
     user_is_author_or_atlas_series_checker_or_atlas_marker,
     user_is_atlas_editor,
     user_is_author_or_atlas_series_checker,
     user_is_atlas_marker,
-    user_is_author_or_atlas_editor_or_atlas_marker,
     user_is_collection_author_or_atlas_editor,
 )
 
@@ -148,9 +147,18 @@ class AuthorOrCheckerRequiredMixin(object):
             raise PermissionDenied()  # or Http404
         return obj
 
+class AtlasEditorRequiredMixin(object):
+    def get_object(self, *args, **kwargs):
+        obj = super().get_object(*args, **kwargs)
+        if (
+            self.request.user.groups.filter(name="atlas_editor").exists()
+            or self.request.user.is_superuser
+        ):
+            return obj
+        raise PermissionDenied("You must be an atlas editor to do this.")  # or Http404
 
 @login_required
-@user_is_author_or_atlas_editor_or_atlas_marker
+@user_has_case_view_access
 def case_detail(request, pk):
     case = get_object_or_404(Case, pk=pk)
 
@@ -417,31 +425,31 @@ class SeriesFindingDelete(RevisionMixin, PermissionRequiredMixin, DeleteView):
         return reverse("atlas:series_detail", kwargs={"pk": series_id})
 
 
-class SeriesDelete(RevisionMixin, AuthorOrCheckerRequiredMixin, DeleteView):
+class SeriesDelete(RevisionMixin, AtlasEditorRequiredMixin, DeleteView):
     model = Series
     template_name = "confirm_delete.html"
     success_url = reverse_lazy("atlas:series_view")
 
 
-class CaseCollectionDelete(RevisionMixin, AuthorOrCheckerRequiredMixin, DeleteView):
+class CaseCollectionDelete(RevisionMixin, AtlasEditorRequiredMixin, DeleteView):
     model = CaseCollection
     template_name = "confirm_delete.html"
     success_url = reverse_lazy("atlas:collection_view")
 
 
-class ConditionDelete(RevisionMixin, AuthorOrCheckerRequiredMixin, DeleteView):
+class ConditionDelete(RevisionMixin, AtlasEditorRequiredMixin, DeleteView):
     model = Condition
     template_name = "confirm_delete.html"
     success_url = reverse_lazy("atlas:condition_view")
 
 
-class FindingDelete(RevisionMixin, AuthorOrCheckerRequiredMixin, DeleteView):
+class FindingDelete(RevisionMixin, AtlasEditorRequiredMixin, DeleteView):
     model = Finding
     template_name = "confirm_delete.html"
     success_url = reverse_lazy("atlas:finding_view")
 
 
-class StructureDelete(RevisionMixin, AuthorOrCheckerRequiredMixin, DeleteView):
+class StructureDelete(RevisionMixin, AtlasEditorRequiredMixin, DeleteView):
     model = Structure
     template_name = "confirm_delete.html"
     success_url = reverse_lazy("atlas:structure_view")
@@ -867,7 +875,7 @@ def add_collection_to_case_form(request, case_id):
 #        return reverse("atlas:case_detail", kwargs={"pk": pk})
 
 
-class AtlasClone(AtlasCreateBase, CreateView):
+class AtlasClone(AtlasCreateBase, AuthorOrCheckerRequiredMixin, CreateView):
     """Clones a existing atlas"""
 
     #    fields = '__all__'
@@ -877,11 +885,23 @@ class AtlasClone(AtlasCreateBase, CreateView):
     def get_initial(self):
         # print(self.request)
         old_object = get_object_or_404(Case, pk=self.kwargs["pk"])
-        initial_data = model_to_dict(old_object, exclude=["id"])
 
+        if (
+            self.request.user.groups.filter(name="atlas_editor").exists()
+            or self.request.user.is_superuser
+        ):
+            pass
+        else:
+            if self.request.user not in old_object.get_author_objects():
+                raise PermissionDenied()  # or Http404
+            else:
+                pass
+
+        initial_data = model_to_dict(old_object, exclude=["id"])
         return initial_data
 
 
+
 @login_required
 @user_is_author_or_atlas_editor
 def atlas_scrap(request, pk):