fixed permissions comments, books

cookbook/views/api.py

@@ -5,7 +5,7 @@ from django.utils.translation import gettext as _
 from django.contrib.auth.decorators import login_required
 from django.shortcuts import redirect
 
-from cookbook.helper.group_helper import group_required
+from cookbook.helper.permission_helper import group_required
 from cookbook.models import Recipe, Sync, Storage
 from cookbook.provider.dropbox import Dropbox
 from cookbook.provider.nextcloud import Nextcloud

cookbook/views/data.py

@@ -7,7 +7,7 @@ from django.utils.translation import ngettext
 from django_tables2 import RequestConfig
 
 from cookbook.forms import SyncForm, BatchEditForm
-from cookbook.helper.group_helper import group_required
+from cookbook.helper.permission_helper import group_required
 from cookbook.models import *
 from cookbook.tables import SyncTable
 

cookbook/views/delete.py

@@ -1,3 +1,4 @@
+from django.contrib import messages
 from django.contrib.auth.mixins import LoginRequiredMixin
 from django.http import HttpResponseRedirect
 from django.shortcuts import get_object_or_404
@@ -5,7 +6,7 @@ from django.urls import reverse_lazy, reverse
 from django.utils.translation import gettext as _
 from django.views.generic import DeleteView
 
-from cookbook.helper.group_helper import GroupRequiredMixin
+from cookbook.helper.permission_helper import GroupRequiredMixin, OwnerRequiredMixin
 from cookbook.models import Recipe, Sync, Keyword, RecipeImport, Storage, Comment, RecipeBook, \
     RecipeBookEntry, MealPlan, Ingredient
 from cookbook.provider.dropbox import Dropbox
@@ -101,7 +102,7 @@ class StorageDelete(GroupRequiredMixin, DeleteView):
         return context
 
 
-class CommentDelete(LoginRequiredMixin, DeleteView):
+class CommentDelete(OwnerRequiredMixin, DeleteView):
     template_name = "generic/delete_template.html"
     model = Comment
     success_url = reverse_lazy('index')
@@ -112,8 +113,7 @@ class CommentDelete(LoginRequiredMixin, DeleteView):
         return context
 
 
-class RecipeBookDelete(GroupRequiredMixin, DeleteView):
-    groups_required = ['user']
+class RecipeBookDelete(OwnerRequiredMixin, DeleteView):
     template_name = "generic/delete_template.html"
     model = RecipeBook
     success_url = reverse_lazy('view_books')
@@ -130,14 +130,20 @@ class RecipeBookEntryDelete(GroupRequiredMixin, DeleteView):
     model = RecipeBookEntry
     success_url = reverse_lazy('view_books')
 
+    def dispatch(self, request, *args, **kwargs):
+        obj = self.get_object()
+        if not (obj.book.created_by == request.user or request.user.is_superuser):
+            messages.add_message(request, messages.ERROR, _('You cannot interact with this object as its not owned by you!'))
+            return HttpResponseRedirect(reverse('index'))
+        return super(RecipeBookEntryDelete, self).dispatch(request, *args, **kwargs)
+
     def get_context_data(self, **kwargs):
         context = super(RecipeBookEntryDelete, self).get_context_data(**kwargs)
         context['title'] = _("Bookmarks")
         return context
 
 
-class MealPlanDelete(GroupRequiredMixin, DeleteView):
-    groups_required = ['user']
+class MealPlanDelete(OwnerRequiredMixin, DeleteView):
     template_name = "generic/delete_template.html"
     model = MealPlan
     success_url = reverse_lazy('view_plan')

cookbook/views/edit.py

@@ -15,7 +15,9 @@ from django.views.generic import UpdateView
 
 from cookbook.forms import ExternalRecipeForm, KeywordForm, StorageForm, SyncForm, InternalRecipeForm, CommentForm, \
     MealPlanForm, UnitMergeForm, IngredientMergeForm, IngredientForm
-from cookbook.helper.group_helper import group_required, GroupRequiredMixin
+from cookbook.helper.permission_helper import group_required, GroupRequiredMixin
+
+from cookbook.helper.permission_helper import OwnerRequiredMixin
 from cookbook.models import Recipe, Sync, Keyword, RecipeImport, Storage, Comment, RecipeIngredient, RecipeBook, \
     MealPlan, Unit, Ingredient
 from cookbook.provider.dropbox import Dropbox
@@ -218,20 +220,11 @@ def edit_storage(request, pk):
     return render(request, 'generic/edit_template.html', {'form': form})
 
 
-class CommentUpdate(LoginRequiredMixin, UpdateView):
+class CommentUpdate(OwnerRequiredMixin, UpdateView):
     template_name = "generic/edit_template.html"
     model = Comment
     form_class = CommentForm
 
-    # TODO add msg box
-
-    def dispatch(self, request, *args, **kwargs):
-        obj = self.get_object()
-        if not (obj.created_by == request.user or request.user.is_superuser):
-            messages.add_message(request, messages.ERROR, _('You cannot edit this comment!'))
-            return HttpResponseRedirect(reverse('view_recipe', args=[obj.recipe.pk]))
-        return super(CommentUpdate, self).dispatch(request, *args, **kwargs)
-
     def get_success_url(self):
         return reverse('edit_comment', kwargs={'pk': self.object.pk})
 
@@ -259,14 +252,11 @@ class ImportUpdate(GroupRequiredMixin, UpdateView):
         return context
 
 
-class RecipeBookUpdate(GroupRequiredMixin, UpdateView):
-    groups_required = ['user']
+class RecipeBookUpdate(OwnerRequiredMixin, UpdateView):
     template_name = "generic/edit_template.html"
     model = RecipeBook
     fields = ['name']
 
-    # TODO add msg box
-
     def get_success_url(self):
         return reverse('view_books')
 
@@ -276,14 +266,11 @@ class RecipeBookUpdate(GroupRequiredMixin, UpdateView):
         return context
 
 
-class MealPlanUpdate(GroupRequiredMixin, UpdateView):
-    groups_required = ['user']
+class MealPlanUpdate(OwnerRequiredMixin, UpdateView):
     template_name = "generic/edit_template.html"
     model = MealPlan
     form_class = MealPlanForm
 
-    # TODO add msg box
-
     def get_success_url(self):
         return reverse('view_plan')
 

cookbook/views/import_export.py

@@ -11,7 +11,7 @@ from django.urls import reverse_lazy
 
 from django.utils.translation import gettext as _
 from cookbook.forms import ExportForm, ImportForm
-from cookbook.helper.group_helper import group_required
+from cookbook.helper.permission_helper import group_required
 from cookbook.models import RecipeIngredient, Recipe, Unit, Ingredient, Keyword
 
 

cookbook/views/lists.py

@@ -5,7 +5,7 @@ from django.utils.translation import gettext as _
 from django_tables2 import RequestConfig
 
 from cookbook.filters import IngredientFilter
-from cookbook.helper.group_helper import group_required
+from cookbook.helper.permission_helper import group_required
 from cookbook.models import Keyword, SyncLog, RecipeImport, Storage, Ingredient
 from cookbook.tables import KeywordTable, ImportLogTable, RecipeImportTable, StorageTable, IngredientTable
 

cookbook/views/new.py

@@ -10,7 +10,7 @@ from django.views.generic import CreateView
 
 from cookbook.forms import ImportRecipeForm, RecipeImport, KeywordForm, Storage, StorageForm, InternalRecipeForm, \
     RecipeBookForm, MealPlanForm
-from cookbook.helper.group_helper import GroupRequiredMixin, group_required
+from cookbook.helper.permission_helper import GroupRequiredMixin, group_required
 from cookbook.models import Keyword, Recipe, RecipeBook, MealPlan
 
 
@@ -108,7 +108,7 @@ class RecipeBookCreate(GroupRequiredMixin, CreateView):
 
     def form_valid(self, form):
         obj = form.save(commit=False)
-        obj.user = self.request.user
+        obj.created_by = self.request.user
         obj.save()
         return HttpResponseRedirect(reverse('view_books'))
 
@@ -133,7 +133,7 @@ class MealPlanCreate(GroupRequiredMixin, CreateView):
 
     def form_valid(self, form):
         obj = form.save(commit=False)
-        obj.user = self.request.user
+        obj.created_by = self.request.user
         obj.save()
         return HttpResponseRedirect(reverse('view_plan'))
 

cookbook/views/views.py

@@ -12,7 +12,7 @@ from django.utils.translation import gettext as _
 
 from cookbook.filters import RecipeFilter
 from cookbook.forms import *
-from cookbook.helper.group_helper import group_required
+from cookbook.helper.permission_helper import group_required
 from cookbook.tables import RecipeTable
 
 
@@ -83,7 +83,7 @@ def recipe_view(request, pk):
 def books(request):
     book_list = []
 
-    books = RecipeBook.objects.filter(user=request.user).all()
+    books = RecipeBook.objects.filter(created_by=request.user).all()
 
     for b in books:
         book_list.append({'book': b, 'recipes': RecipeBookEntry.objects.filter(book=b).all()})