From ef07207fde860b1807351692c834fd82e5237dcc Mon Sep 17 00:00:00 2001 From: andrey Date: Tue, 29 Aug 2017 11:09:00 +0300 Subject: [PATCH 1/2] perm middleware --- access/middleware.py | 14 ++++++++++++++ lms/settings.py | 3 ++- 2 files changed, 16 insertions(+), 1 deletion(-) create mode 100644 access/middleware.py diff --git a/access/middleware.py b/access/middleware.py new file mode 100644 index 0000000..edbb907 --- /dev/null +++ b/access/middleware.py @@ -0,0 +1,14 @@ +from django.http import HttpResponseForbidden + + +class CheckPerm(object): + + @staticmethod + def process_request(request): + if '/admin' in request.path or '/management' in request.path or '/analytics' in request.path: + if not request.user.is_authenticated(): + return HttpResponseForbidden() + + if not (request.user.in_role == "M" or request.user.in_role == "S" or request.user.in_role == "A" or request.user.is_admin): + return HttpResponseForbidden() + diff --git a/lms/settings.py b/lms/settings.py index 4e062db..ed6cce3 100644 --- a/lms/settings.py +++ b/lms/settings.py @@ -103,6 +103,7 @@ MIDDLEWARE_CLASSES = [ 'django.contrib.auth.middleware.SessionAuthenticationMiddleware', 'django.contrib.messages.middleware.MessageMiddleware', 'django.middleware.clickjacking.XFrameOptionsMiddleware', + 'access.middleware.CheckPerm', ] ROOT_URLCONF = 'lms.urls' @@ -136,7 +137,7 @@ DATABASES = { 'NAME': os.environ.get('DB_NAME', 'codemy'), 'USER': os.environ.get('PG_ENV_POSTGRES_USER', 'team'), 'PASSWORD': os.environ.get('PG_ENV_POSTGRES_PASSWORD', 'nu5Xefise'), - 'HOST': os.environ.get('PG_PORT_5432_TCP_ADDR', '192.168.0.6'), + 'HOST': os.environ.get('PG_PORT_5432_TCP_ADDR', '127.0.0.1'), 'PORT': os.environ.get('PG_PORT_5432_TCP_PORT', '5432'), }, } From 76ef758f4e9f855311c2dab5eaa885ded7e1161d Mon Sep 17 00:00:00 2001 From: andrey Date: Wed, 30 Aug 2017 10:45:41 +0300 Subject: [PATCH 2/2] =?UTF-8?q?=D0=92=D0=B5=D1=80=D0=BD=D1=83=D0=BB=20?= =?UTF-8?q?=D1=85=D0=BE=D1=81=D1=82=20=D0=B4=D0=BB=D1=8F=20=D0=B1=D0=B4=20?= =?UTF-8?q?=D0=BD=D0=B0=20=D0=BC=D0=B5=D1=81=D1=82=D0=BE=20=D0=B8=D0=B7?= =?UTF-8?q?=D0=BC=D0=B5=D0=BD=D0=B8=D0=BB=20=D0=B4=D0=BB=D0=B8=D0=BD=D1=83?= =?UTF-8?q?=20=D1=81=D1=82=D1=80=D0=BE=D0=BA?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- access/middleware.py | 10 ++++++---- lms/settings.py | 2 +- 2 files changed, 7 insertions(+), 5 deletions(-) diff --git a/access/middleware.py b/access/middleware.py index edbb907..ed280f9 100644 --- a/access/middleware.py +++ b/access/middleware.py @@ -2,13 +2,15 @@ from django.http import HttpResponseForbidden class CheckPerm(object): - @staticmethod def process_request(request): - if '/admin' in request.path or '/management' in request.path or '/analytics' in request.path: + if '/admin' in request.path or "/management" in request.path \ + or '/analytics' in request.path: + if not request.user.is_authenticated(): return HttpResponseForbidden() - if not (request.user.in_role == "M" or request.user.in_role == "S" or request.user.in_role == "A" or request.user.is_admin): - return HttpResponseForbidden() + if not (request.user.in_role == "M" or request.user.in_role == "S" + or request.user.in_role == "A" or request.user.is_admin): + return HttpResponseForbidden() diff --git a/lms/settings.py b/lms/settings.py index ed6cce3..6d0e179 100644 --- a/lms/settings.py +++ b/lms/settings.py @@ -137,7 +137,7 @@ DATABASES = { 'NAME': os.environ.get('DB_NAME', 'codemy'), 'USER': os.environ.get('PG_ENV_POSTGRES_USER', 'team'), 'PASSWORD': os.environ.get('PG_ENV_POSTGRES_PASSWORD', 'nu5Xefise'), - 'HOST': os.environ.get('PG_PORT_5432_TCP_ADDR', '127.0.0.1'), + 'HOST': os.environ.get('PG_PORT_5432_TCP_ADDR', '192.168.0.6'), 'PORT': os.environ.get('PG_PORT_5432_TCP_PORT', '5432'), }, }