From 3c12c33911b7a97a8125d1e8cf6b7c3cc3fb5675 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E5=85=AB=E5=8D=83=E6=B5=81?=
 <40739051+jym503558564@users.noreply.github.com>
Date: Wed, 25 Sep 2019 16:58:41 +0800
Subject: [PATCH] =?UTF-8?q?[Update]=20=E4=BF=AE=E6=94=B9=E5=BD=93=E4=BB=85?=
 =?UTF-8?q?=E6=98=AF=E5=BD=93=E5=89=8D=E7=BB=84=E7=BB=87=E5=AE=A1=E8=AE=A1?=
 =?UTF-8?q?=E5=91=98=E6=97=B6=EF=BC=8C=E9=9A=90=E8=97=8F=E7=BB=88=E6=96=AD?=
 =?UTF-8?q?=E4=BC=9A=E8=AF=9D=E6=8C=89=E9=92=AE=20(#3275)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* [Update] 修改会话列表中终断按钮，批量终断，SessionViewSet 的权限控制
---
 apps/terminal/api/session.py                       | 7 ++++++-
 apps/terminal/templates/terminal/session_list.html | 4 ++--
 2 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/apps/terminal/api/session.py b/apps/terminal/api/session.py
index 5303bbdb2..7071ddd33 100644
--- a/apps/terminal/api/session.py
+++ b/apps/terminal/api/session.py
@@ -26,7 +26,7 @@ logger = get_logger(__name__)
 class SessionViewSet(OrgBulkModelViewSet):
     queryset = Session.objects.all()
     serializer_class = serializers.SessionSerializer
-    permission_classes = (IsOrgAdminOrAppUser | IsOrgAuditor, )
+    permission_classes = (IsOrgAdminOrAppUser, )
     filter_fields = [
         "user", "asset", "system_user", "remote_addr",
         "protocol", "terminal", "is_finished",
@@ -53,6 +53,11 @@ class SessionViewSet(OrgBulkModelViewSet):
             serializer.validated_data["system_user"] = _system_user.name
         return super().perform_create(serializer)
 
+    def get_permissions(self):
+        if self.request.method.lower() in ['get']:
+            self.permission_classes = (IsOrgAdminOrAppUser | IsOrgAuditor, )
+        return super().get_permissions()
+
 
 class SessionReplayViewSet(viewsets.ViewSet):
     serializer_class = serializers.ReplaySerializer
diff --git a/apps/terminal/templates/terminal/session_list.html b/apps/terminal/templates/terminal/session_list.html
index 6ac9b7bd8..d23d9be02 100644
--- a/apps/terminal/templates/terminal/session_list.html
+++ b/apps/terminal/templates/terminal/session_list.html
@@ -41,7 +41,7 @@
     </table>
 
     <div id="actions" class="hide">
-        {% if type == "online" %}
+        {% if type == "online" and request.user.can_admin_current_org %}
         <div class="input-group">
             <select class="form-control m-b" style="width: auto" id="slct_bulk_update">
                 <option value="terminate">{% trans 'Terminate selected' %}</option>
@@ -140,7 +140,7 @@ function initTable() {
                     replayBtn = replayBtn.replace("disabled", "")
                 }
                 var termBtn = '<a class="btn btn-xs btn-danger btn-term" disabled value="sessionID" terminal="terminalID" >{% trans "Terminate" %}</a>';
-                if ("{{ request.user.is_org_admin }}" === "True") {
+                if ("{{ request.user.can_admin_current_org }}" === "True") {
                     termBtn = termBtn.replace("disabled", "")
                         .replace("sessionID", cellData)
                         .replace("terminalID", rowData.terminal)