diff options
| -rw-r--r-- | ishtar_common/ishtar_menu.py | 4 | ||||
| -rw-r--r-- | ishtar_common/models_imports.py | 4 | ||||
| -rw-r--r-- | ishtar_common/urls.py | 8 | ||||
| -rw-r--r-- | ishtar_common/views.py | 4 |
4 files changed, 11 insertions, 9 deletions
diff --git a/ishtar_common/ishtar_menu.py b/ishtar_common/ishtar_menu.py index a257fc31c..5c2d1bdb1 100644 --- a/ishtar_common/ishtar_menu.py +++ b/ishtar_common/ishtar_menu.py @@ -164,13 +164,13 @@ MENU_SECTIONS = [ "import-list", _("Current imports"), model=models.Import, - access_controls=["change_import"], + access_controls=["view_import", "change_import"], ), MenuItem( "import-list-old", _("Old imports"), model=models.Import, - access_controls=["change_import"], + access_controls=["view_import", "change_import"], ), ], ), diff --git a/ishtar_common/models_imports.py b/ishtar_common/models_imports.py index 53a3c068f..2b181165b 100644 --- a/ishtar_common/models_imports.py +++ b/ishtar_common/models_imports.py @@ -1471,8 +1471,10 @@ class BaseImport(models.Model, OwnPerms, SheetItem): :return: import query """ q = cls.objects + if not isinstance(perm, (list, tuple)): + perm = [perm] if user.is_superuser or (hasattr(user, "ishtaruser") and user.ishtaruser and - user.ishtaruser.has_right(perm)): + any(user.ishtaruser.has_right(p) for p in perm)): return q q = q.filter(Q(importer_type__users__pk=user.ishtaruser.pk)) return q diff --git a/ishtar_common/urls.py b/ishtar_common/urls.py index b7a43f82a..babdece35 100644 --- a/ishtar_common/urls.py +++ b/ishtar_common/urls.py @@ -230,22 +230,22 @@ urlpatterns = [ ), url( r"^import-list/$", - check_rights(["change_import", "change_own_import"])(views.ImportListView.as_view()), + check_rights(["view_import", "change_import", "change_own_import"])(views.ImportListView.as_view()), name="current_imports", ), url( r"^import-list-table/$", - check_rights(["change_import", "change_own_import"])(views.ImportListTableView.as_view()), + check_rights(["view_import", "change_import", "change_own_import"])(views.ImportListTableView.as_view()), name="current_imports_table", ), url( r"^import-get-status/$", - check_rights(["change_import", "change_own_import"])(views.import_get_status), + check_rights(["view_import", "change_import", "change_own_import"])(views.import_get_status), name="import_get_status", ), url( r"^import-list-old/$", - check_rights(["change_import", "change_own_import"])(views.ImportOldListView.as_view()), + check_rights(["view_import", "change_import", "change_own_import"])(views.ImportOldListView.as_view()), name="old_imports", ), url( diff --git a/ishtar_common/views.py b/ishtar_common/views.py index a990fdfa6..d4dabbe5d 100644 --- a/ishtar_common/views.py +++ b/ishtar_common/views.py @@ -1656,9 +1656,9 @@ class ImportListView(IshtarMixin, LoginRequiredMixin, ListView): user = self.request.user if not user.pk or not user.ishtaruser: raise Http404() - q1 = self._queryset_filter(self.model.query_can_access(user, "change_import")) + q1 = self._queryset_filter(self.model.query_can_access(user, ["view_import", "change_import"])) q1 = q1.filter(group__isnull=True).order_by("-end_date", "-creation_date", "-pk") - q2 = self._queryset_filter(models.ImportGroup.query_can_access(user, "change_import")) + q2 = self._queryset_filter(models.ImportGroup.query_can_access(user, ["view_import", "change_import"])) q2 = q2.order_by("-end_date", "-creation_date", "-pk") values = list(reversed(sorted(list(q1) + list(q2), key=lambda x: (x.end_date or x.creation_date)))) can_edit_all, can_delete_all, can_edit_own, can_delete_own = models.Import.get_permissions_for_actions( |