superuser mode

1 files changed, 39 insertions, 17 deletions

diff --git a/server/views.py b/server/views.py
index d295de6..481c177 100644
--- a/server/views.py
+++ b/server/views.py
@@ -46,14 +46,21 @@ def isCapi_enabled(user):
         return False

 

 # function to get group list based on permissions of user

-def getGroups(user):

+def getGroups(request):

+    user = request.user

     if user.is_staff:

         groups = list(user.groups.all())

     else:

         groups = list(user.groups.all())[1:]

 

-    if user.is_superuser:

+    if user.is_superuser and request.session.get("superuser"):

         groups = list(Group.objects.all())

+        if "superuser_group" in request.session:

+            su_group = Group.objects.get(name=request.session["superuser_group"])

+            if su_group in groups:

+                groups.remove(su_group)

+            groups = [su_group] + groups

+

     print(groups)

     

     return groups

@@ -62,7 +69,7 @@ def getGroups(user):
 def index(request):

     context = {}

 

-    groups = getGroups(request.user)

+    groups = getGroups(request)

 

     q_obj = Q(group__in=groups)

 

@@ -90,6 +97,21 @@ def index(request):
 

     # check if changing settings

     if request.method == "POST" and request.user.is_staff:

+        if request.user.is_superuser and "su_status" in request.POST:

+            action = request.POST["su_status"]

+            if action == "change":

+                if "superuser" not in request.session:

+                    request.session["superuser"] = True

+                else:

+                    request.session["superuser"] = not request.session["superuser"]

+

+                if "superuser_group" not in request.session:

+                    request.session["superuser_group"] = "reparto"

+            elif action in ["diga", "muta", "reparto", "posto", "clan"]:

+                request.session["superuser_group"] = action

+

+            return HttpResponseRedirect("/server")

+

         for i in groups:

             settings = GroupSettings.objects.filter(group=i)

 

@@ -123,7 +145,7 @@ def uapprove(request):
     data = []

     if request.method == "POST":

         # get group name and obj

-        group = getGroups(request.user)[0]

+        group = getGroups(request)[0]

         parent_group = group.name

 

         # get permission object

@@ -188,7 +210,7 @@ def docapprove(request):
     context = {}

     data = []

 

-    groups = getGroups(request.user)

+    groups = getGroups(request)

 

     # setup variables for error text and success text

     error = False

@@ -299,7 +321,7 @@ def docapprove(request):
 @staff_member_required

 def approve_direct(request):

     # get groups that the user is manager of

-    groups = getGroups(request.user)

+    groups = getGroups(request)

 

     if request.method == "POST" and "doc_code" in request.POST:

         # if user submitted the form to approve a document

@@ -359,7 +381,7 @@ def approve_direct(request):
 def ulist(request):

     context = {}

     # group name and obj

-    group = getGroups(request.user)[0]

+    group = getGroups(request)[0]

 

     if request.method == "POST":

         # request to download document

@@ -466,7 +488,7 @@ def doctype(request):
     group_check = 'checked="checked"'

 

     # if user not staff of primary get only non primary groups

-    groups = getGroups(request.user)

+    groups = getGroups(request)

 

     if request.method == "POST":

         # check if request to edit

@@ -770,7 +792,7 @@ def custom_parameters_preview(request):
 def doccreate(request):

     context = {}

 

-    groups = getGroups(request.user)

+    groups = getGroups(request)

     # if user is not staff of primary set default group to secondary and default public type

     if request.user.is_staff:

         group_private = False

@@ -905,7 +927,7 @@ def docedit(request):
 

 @user_passes_test(isStaff)

 def docedit_wrapper(request, context):

-    groups = getGroups(request.user)

+    groups = getGroups(request)

     group = groups[0]

 

     if request.user.is_staff and "group" in context.keys():

@@ -1006,7 +1028,7 @@ def doclist(request):
     context = {}

 

     # group name and obj

-    parent_groups = getGroups(request.user)

+    parent_groups = getGroups(request)

 

     # create typezone

     zurich = pytz.timezone('Europe/Zurich')

@@ -1183,7 +1205,7 @@ def doclist(request):
     # get types and users for chips autocompletation

     if request.user.is_staff:

         auto_types = DocumentType.objects.filter(

-            Q(group_private=False) | Q(group=getGroups(request.user)[0]))

+            Q(group_private=False) | Q(group=getGroups(request)[0]))

     else:

         auto_types = DocumentType.objects.filter(Q(group_private=False))

 

@@ -1532,7 +1554,7 @@ def zip_documents(docs, session_key):
 @user_passes_test(isStaff)

 def upload_doc(request):

     # setup group based on staff primary or not

-    groups = getGroups(request.user)

+    groups = getGroups(request)

 

     # setup variables for error text and success text

     error = False

@@ -1601,7 +1623,7 @@ def upload_doc(request):
 def docpreview(request):

     context = {}

     # check for permissions

-    groups = getGroups(request.user)

+    groups = getGroups(request)

 

     if request.method == "POST":

         # get document code

@@ -1652,7 +1674,7 @@ def docpreview(request):
 @user_passes_test(isStaff)

 def data_request(request):

     context = {}

-    parent_group = getGroups(request.user)[0]

+    parent_group = getGroups(request)[0]

 

     if request.method == "POST":

         if "request" not in request.POST.keys():

@@ -1788,7 +1810,7 @@ def media_request(request, id=0, t="", flag=""):
     if flag == "usercode":

         usercode = UserCode.objects.get(id=id)

         if request.user.is_staff:

-            groups = getGroups(request.user)

+            groups = getGroups(request)

             usercode_group = usercode.user.groups[0]

             if usercode_group not in groups:

                 return

@@ -1805,7 +1827,7 @@ def media_request(request, id=0, t="", flag=""):
         doc = Document.objects.get(id=id)

         doc_group = doc.group

 

-        groups = getGroups(request.user)

+        groups = getGroups(request)

         group_view = Group.objects.filter(name="capi") in groups and GroupSettings.objects.filter(group__name=doc_group).filter(view_documents=True).count() != 0

 

         # check if user can view media