IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2025-02-25 18:55:28 -06:00
Code Issues Packages Projects Releases Wiki Activity

webui: support wildcard attribute level rights

Browse Source 
Reproduction:
* add 'extensibleObject' object class to target object

https://fedorahosted.org/freeipa/ticket/4380

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
This commit is contained in:
Petr Vobornik 2014-06-19 17:09:38 +02:00
parent c475c093c9
commit 855c59c7fc
1 changed files with 15 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
install/ui/src/freeipa/field.js
View File

@ -450,6 +450,12 @@ field.field = IPA.field = function(spec) {
var writable = true; var writable = true;
function has_write(record, param) {
var rights = record.attributelevelrights[param];
var has = !!rights && rights.indexOf('w') > -1;
return has;
}
if (that.metadata) { if (that.metadata) {
if (that.metadata.primary_key) { if (that.metadata.primary_key) {
writable = false; writable = false;
@ -460,21 +466,21 @@ field.field = IPA.field = function(spec) {
} }
} }
if (record && record.attributelevelrights) { if (record && record.attributelevelrights && writable) {
var rights = record.attributelevelrights[that.acl_param]; var rights = record.attributelevelrights[that.acl_param];
var oc_rights= record.attributelevelrights['objectclass']; var write_attr = has_write(record, that.acl_param);
var write_oc = oc_rights && oc_rights.indexOf('w') > -1; var write_all = has_write(record, '*');
// Some objects in LDAP may not have set proper object class and // Some objects in LDAP may not have proper object class set and
// therefore server doesn't send proper attribute rights. Flag // therefore server doesn't send proper attribute rights. Flag
// 'w_if_no_aci' should be used when we want to ensure that UI // 'w_if_no_aci' should be used when we want to ensure that UI
// shows edit interface in such cases. Usable only when user can // shows edit interface in such cases. Usable only when user can
// modify object classes. // modify object classes.
// For all others, lack of rights means no write. var write_oc = has_write(record, 'objectclass');
if ((!rights && !(that.flags.indexOf('w_if_no_aci') > -1 && write_oc)) || var may_add_oc = !rights && write_oc && that.flags.indexOf('w_if_no_aci') > -1;
(rights && rights.indexOf('w') < 0)) {
writable = false; // If no rights, change writable to False:
} writable = write_attr || write_all || may_add_oc;
} }
that.set_writable(writable); that.set_writable(writable);