def inner(request, *args, **kwargs):
entry = kwargs.get("entry")
if not entry:
return f(request, *args, **kwargs)
auth_user = Tbluser.objects.get(id=request.session.get("user_id"))
# if the provided entry ID is not here, then we're being duped.
try:
entry = PendingApproval.objects.get(entry_id=entry, closed=False)
except PendingApproval.DoesNotExist:
suspicious_log.critical(
"An accept/edit check was made by %s for a non-existent entry."
% auth_user.name())
raise Http404
if not entry.entry.user_can_see(auth_user):
raise Http404
return f(request, *args, **kwargs)
def inner(request, *args, **kwargs):
entry = kwargs.get("entry")
if not entry:
return f(request, *args, **kwargs)
auth_user = Tbluser.objects.get(
id=request.session.get("user_id")
)
# if the provided entry ID is not here, then we're being duped.
try:
entry = PendingApproval.objects.get(entry_id=entry, closed=False)
except PendingApproval.DoesNotExist:
suspicious_log.critical(
"An accept/edit check was made by %s for a non-existent entry." % auth_user.name()
)
raise Http404
if not entry.entry.user_can_see(auth_user):
raise Http404
return f(request, *args, **kwargs)
def user_can_see(self, user):
'''Method checks to see if the user passed-in is privvy to view
the details of this TrackingEntry.
:param user: A Tbluser instance.
:return: A boolean indicating whether or not the user is
allowed to view this entry.
'''
from timetracker.tracker.models import Tbluser
try:
user.get_subordinates().get(id=self.user.id)
return True
except Tbluser.DoesNotExist:
suspicious_log.critical(
"An accept/edit check was made by %s for an entry which " \
% self.user.name() + \
"is for a person outside their team"
)
return False
def user_can_see(self, user):
'''Method checks to see if the user passed-in is privvy to view
the details of this TrackingEntry.
:param user: A Tbluser instance.
:return: A boolean indicating whether or not the user is
allowed to view this entry.
'''
from timetracker.tracker.models import Tbluser
try:
user.get_subordinates().get(id=self.user.id)
return True
except Tbluser.DoesNotExist:
suspicious_log.critical(
"An accept/edit check was made by %s for an entry which " \
% self.user.name() + \
"is for a person outside their team"
)
return False
