Mercurial > p > roundup > code
comparison roundup/mailgw.py @ 3583:338f204ea2a5
fix security check in mailgw [SF#1442145]
| author | Richard Jones <richard@users.sourceforge.net> |
|---|---|
| date | Fri, 03 Mar 2006 00:13:20 +0000 |
| parents | 7f1e2d650486 |
| children | 1113e1456093 |
comparison
equal
deleted
inserted
replaced
| 3582:026adc5f1e13 | 3583:338f204ea2a5 |
|---|---|
| 70 set() method to add the message to the item's spool; in the second case we | 70 set() method to add the message to the item's spool; in the second case we |
| 71 are calling the create() method to create a new node). If an auditor raises | 71 are calling the create() method to create a new node). If an auditor raises |
| 72 an exception, the original message is bounced back to the sender with the | 72 an exception, the original message is bounced back to the sender with the |
| 73 explanatory message given in the exception. | 73 explanatory message given in the exception. |
| 74 | 74 |
| 75 $Id: mailgw.py,v 1.173 2006-03-02 23:45:22 richard Exp $ | 75 $Id: mailgw.py,v 1.174 2006-03-03 00:13:20 richard Exp $ |
| 76 """ | 76 """ |
| 77 __docformat__ = 'restructuredtext' | 77 __docformat__ = 'restructuredtext' |
| 78 | 78 |
| 79 import string, re, os, mimetools, cStringIO, smtplib, socket, binascii, quopri | 79 import string, re, os, mimetools, cStringIO, smtplib, socket, binascii, quopri |
| 80 import time, random, sys, logging | 80 import time, random, sys, logging |
| 849 raise Unauthorized, 'You are not permitted to access '\ | 849 raise Unauthorized, 'You are not permitted to access '\ |
| 850 'this tracker.' | 850 'this tracker.' |
| 851 | 851 |
| 852 # make sure they're allowed to edit or create this class of information | 852 # make sure they're allowed to edit or create this class of information |
| 853 if nodeid: | 853 if nodeid: |
| 854 if not self.db.security.hasPermission('Edit', author, classname): | 854 if not self.db.security.hasPermission('Edit', author, classname, |
| 855 itemid=nodeid): | |
| 855 raise Unauthorized, 'You are not permitted to '\ | 856 raise Unauthorized, 'You are not permitted to '\ |
| 856 'edit %s.'%classname | 857 'edit %s.'%classname |
| 857 else: | 858 else: |
| 858 if not self.db.security.hasPermission('Create', author, classname): | 859 if not self.db.security.hasPermission('Create', author, classname): |
| 859 raise Unauthorized, 'You are not permitted to '\ | 860 raise Unauthorized, 'You are not permitted to '\ |