🐛 prevent bulk update when no permission is set (refs #6098)

1 files changed, 21 insertions, 2 deletions

diff --git a/ishtar_common/forms.py b/ishtar_common/forms.py
index ffe44298c..f0e900208 100644
--- a/ishtar_common/forms.py
+++ b/ishtar_common/forms.py
@@ -1292,7 +1292,7 @@ class QAForm(CustomForm, ManageOldType):
     def __init__(self, *args, **kwargs):
         self.items = kwargs.pop("items")
         self.confirm = kwargs.pop("confirm")
-        super(QAForm, self).__init__(*args, **kwargs)
+        super().__init__(*args, **kwargs)
         len_items = len(self.items)
         for k in list(self.fields.keys()):
             if self.MULTI and len_items > 1 and k in self.SINGLE_FIELDS:
@@ -1338,7 +1338,7 @@ class QAForm(CustomForm, ManageOldType):
         value = self.cleaned_data[base_key]
         if not value:
             return
-        key = base_key[len(self.PREFIX) :]
+        key = base_key[len(self.PREFIX):]
         field = item._meta.get_field(key)
         if getattr(field, "related_model", None):
             is_list = isinstance(value, (list, tuple))
@@ -1389,7 +1389,21 @@ class QAForm(CustomForm, ManageOldType):
         return value
 
     def save(self, items, user):
+        if not items or not user.ishtaruser:
+            return
+        model = items[0].__class__._meta
+        full_permission = f"{model.app_label}.change_{model.model_name}"
+        own_permission = f"{model.app_label}.change_own_{model.model_name}"
+        has_full_permission = user.ishtaruser.has_permission(full_permission)
+        if not has_full_permission:
+            if not user.ishtaruser.has_permission(own_permission):
+                return _("You don't have sufficient permissions to do this action.")
+        errors = []
         for item in items:
+            if not has_full_permission:
+                if not user.ishtaruser.has_permission(own_permission, item):
+                    errors.append(str(item))
+                    continue
             for base_key in self.cleaned_data:
                 if hasattr(self, "_set_" + base_key):
                     getattr(self, "_set_" + base_key)(item, user)
@@ -1398,6 +1412,11 @@ class QAForm(CustomForm, ManageOldType):
             item.history_modifier = user
             item._cached_label_checked = False
             item.save()
+        if not errors:
+            return
+        msg = str(_("You don't have sufficient permissions to edit: "))
+        msg2 = str(_("Other changes (if any) have been made successfully."))
+        return f"{msg}{' ; '.join(errors)}. {msg2}"
 
 
 class DocumentGenerationForm(forms.Form):