diff options
Diffstat (limited to '')
| -rw-r--r-- | server/views.py | 99 |
1 files changed, 33 insertions, 66 deletions
diff --git a/server/views.py b/server/views.py index 12b79e9..9babb92 100644 --- a/server/views.py +++ b/server/views.py @@ -45,15 +45,20 @@ def isCapi_enabled(user): else:
return False
+# function to get group list based on permissions of user
+def getGroups(user):
+ if user.is_staff:
+ groups = user.groups.all()
+ else:
+ groups = user.groups.all()[1:]
+
+ return groups
+
@user_passes_test(isStaff)
def index(request):
context = {}
- # if user is staff of not primary show only public types
- if request.user.is_staff:
- groups = request.user.groups.all()
- else:
- groups = request.user.groups.all()[1:]
+ groups = getGroups(request.user)
q_obj = Q(group__in=groups)
@@ -180,11 +185,7 @@ def docapprove(request): context = {}
data = []
- # if user not staff of primary has only control of non primary groups
- if request.user.is_staff:
- groups = request.user.groups.values_list('name', flat=True)
- else:
- groups = request.user.groups.values_list('name', flat=True)[1:]
+ groups = getGroups(request.user)
# setup variables for error text and success text
error = False
@@ -295,10 +296,7 @@ def docapprove(request): @staff_member_required
def approve_direct(request):
# get groups that the user is manager of
- if request.user.is_staff:
- groups = request.user.groups.values_list('name', flat=True)
- else:
- groups = request.user.groups.values_list('name', flat=True)[1:]
+ groups = getGroups(request.user)
if request.method == "POST" and "doc_code" in request.POST:
# if user submitted the form to approve a document
@@ -358,8 +356,7 @@ def approve_direct(request): def ulist(request):
context = {}
# group name and obj
- parent_group = request.user.groups.values_list('name', flat=True)[0]
- group = Group.objects.get(name=parent_group)
+ group = getGroups(request.user)[0]
if request.method == "POST":
# request to download document
@@ -426,7 +423,7 @@ def ulist(request): # list users with their documents
permission = Permission.objects.get(codename="approved")
- usercodes = UserCode.objects.filter(Q(user__user_permissions=permission) | Q(user__is_staff=True)).filter(user__groups__name__contains=parent_group).select_related("user", "medic").order_by("user__last_name")
+ usercodes = UserCode.objects.filter(Q(user__user_permissions=permission) | Q(user__is_staff=True)).filter(user__groups__contains=group).select_related("user", "medic").order_by("user__last_name")
vac_file = ["/server/media/", "/vac_certificate/usercode"]
health_file = ["/server/media/", "/health_care_certificate/usercode"]
@@ -466,11 +463,7 @@ def doctype(request): group_check = 'checked="checked"'
# if user not staff of primary get only non primary groups
- if request.user.is_staff:
- parent_groups = request.user.groups.values_list('name', flat=True)
- else:
- parent_groups = request.user.groups.values_list('name', flat=True)[
- 1:]
+ groups = getGroups(request.user)
if request.method == "POST":
# check if request to edit
@@ -478,7 +471,7 @@ def doctype(request): document_type = DocumentType.objects.get(id=request.POST["action"][1:])
# check if user has permission on the document
- if document_type.group.name not in parent_groups:
+ if document_type.group not in groups:
return
enabled_check = 'checked="checked"' if document_type.enabled else ""
@@ -504,7 +497,7 @@ def doctype(request): document_type = DocumentType.objects.get(id=request.POST["action"][1:])
# check if user has permission on the document
- if document_type.group.name not in parent_groups:
+ if document_type.group not in groups:
return
docs = Document.objects.filter(document_type=document_type).select_related("personal_data", "medical_data", "user")
@@ -578,7 +571,7 @@ def doctype(request): document_type = DocumentType.objects.get(id=request.POST["action"][1:])
# check if user has permission on the document
- if document_type.group.name not in parent_groups:
+ if document_type.group not in groups:
return
docs = Document.objects.filter(document_type=document_type)
@@ -660,7 +653,7 @@ def doctype(request): if i.isdigit():
docc = DocumentType.objects.get(id=i)
# check if user has permission
- if docc.group.name in parent_groups:
+ if docc.group in groups:
# execute action
if request.POST["action"] == 'delete':
try:
@@ -700,7 +693,7 @@ def doctype(request): group_bool = True
# get documents from the list
- q_obj = Q(group__name__in=parent_groups)
+ q_obj = Q(group__in=groups)
public_types = DocumentType.objects.filter(q_obj)
@@ -774,22 +767,17 @@ def custom_parameters_preview(request): def doccreate(request):
context = {}
+ groups = getGroups(request.user).values_list('name', flat=True)
# if user is not staff of primary set default group to secondary and default public type
if request.user.is_staff:
- groups = request.user.groups.values_list('name', flat=True)
- parent_group = request.user.groups.values_list('name', flat=True)[
- 0]
group_private = False
private_check = 'checked="checked"'
else:
- groups = request.user.groups.values_list('name', flat=True)[1:]
- parent_group = request.user.groups.values_list('name', flat=True)[
- 1]
group_private = True
private_check = ''
# get group obj
- group = Group.objects.get(name=parent_group)
+ group = groups[0]
# init checkboxes
enabled = False
@@ -914,22 +902,15 @@ def docedit(request): @user_passes_test(isStaff)
def docedit_wrapper(request, context):
+ groups = getGroups(request.user).values_list('name', flat=True)
+ group = Group.objects.get(name=groups[0])
if request.user.is_staff and "group" in context.keys():
- base_group = request.user.groups.values_list('name', flat=True)[0]
- if context["group"] == base_group:
+ if context["group"] == groups[0]:
context["group"] = ""
if request.method == "POST":
if "action" not in request.POST.keys():
- # get groups on which the user has control
- if request.user.is_staff:
- groups = request.user.groups.values_list('name', flat=True)
- else:
- groups = request.user.groups.values_list('name', flat=True)[1:]
-
- group = Group.objects.get(name=groups[0])
-
# get document
doc = DocumentType.objects.get(id=request.POST["doc"])
@@ -1022,15 +1003,7 @@ def doclist(request): context = {}
# group name and obj
- parent_group = request.user.groups.values_list('name', flat=True)[
- 0]
- group = Group.objects.get(name=parent_group)
-
- # if user not staff of primary get secondary groups
- if request.user.is_staff:
- parent_groups = request.user.groups.values_list('name', flat=True)
- else:
- parent_groups = request.user.groups.values_list('name', flat=True)[1:]
+ parent_groups = getGroups(request.user).values_list('name', flat=True)
# create typezone
zurich = pytz.timezone('Europe/Zurich')
@@ -1211,7 +1184,7 @@ def doclist(request): # get types and users for chips autocompletation
if request.user.is_staff:
auto_types = DocumentType.objects.filter(
- Q(group_private=False) | Q(group=group))
+ Q(group_private=False) | Q(group=getGroups(request.user)[0]))
else:
auto_types = DocumentType.objects.filter(Q(group_private=False))
@@ -1560,10 +1533,7 @@ def zip_documents(docs, session_key): @user_passes_test(isStaff)
def upload_doc(request):
# setup group based on staff primary or not
- if request.user.is_staff:
- groups = request.user.groups.values_list('name', flat=True)
- else:
- groups = request.user.groups.values_list('name', flat=True)[1:]
+ groups = getGroups(request.user).values_list('name', flat=True)
# setup variables for error text and success text
error = False
@@ -1632,10 +1602,7 @@ def upload_doc(request): def docpreview(request):
context = {}
# check for permissions
- if request.user.is_staff:
- groups = request.user.groups.values_list('name', flat=True)
- else:
- groups = request.user.groups.values_list('name', flat=True)[1:]
+ groups = getGroups(request.user).values_list('name', flat=True)
if request.method == "POST":
# get document code
@@ -1685,7 +1652,7 @@ def docpreview(request): @user_passes_test(isStaff)
def data_request(request):
context = {}
- parent_group = request.user.groups.values_list('name', flat=True)[0]
+ parent_group = getGroups(request.user).values_list('name', flat=True)[0]
if request.method == "POST":
if "request" not in request.POST.keys():
@@ -1798,8 +1765,8 @@ def media_request(request, id=0, t="", flag=""): if flag == "usercode":
usercode = UserCode.objects.get(id=id)
if request.user.is_staff:
- groups = request.user.groups.values_list('name', flat=True)
- usercode_group = usercode.user.groups.values_list('name', flat=True)[0]
+ groups = getGroups(request.user)
+ usercode_group = usercode.user.groups[0]
if usercode_group not in groups:
return
else:
@@ -1815,7 +1782,7 @@ def media_request(request, id=0, t="", flag=""): doc = Document.objects.get(id=id)
doc_group = doc.group.name
- groups = request.user.groups.values_list('name', flat=True)
+ groups = getGroups(request.user).values_list('name', flat=True)
group_view = "capi" in groups and GroupSettings.objects.filter(group__name=doc_group).filter(view_documents=True).count() != 0
# check if user can view media
|