From 133522487ab7440c3e3c6b08d93fc4e1b07cb3c0 Mon Sep 17 00:00:00 2001 From: zhengxie Date: Thu, 18 May 2017 17:32:28 +0800 Subject: [PATCH 1/3] [api2] Add permissions to share link creation api --- seahub/api2/endpoints/share_links.py | 40 ++++++++++++- seahub/share/models.py | 13 +++++ tests/api/endpoints/test_share_links.py | 75 +++++++++++++++++++++++++ 3 files changed, 125 insertions(+), 3 deletions(-) diff --git a/seahub/api2/endpoints/share_links.py b/seahub/api2/endpoints/share_links.py index e59fa78605..3ff6628e25 100644 --- a/seahub/api2/endpoints/share_links.py +++ b/seahub/api2/endpoints/share_links.py @@ -70,7 +70,7 @@ def get_share_link_info(fileshare): data['ctime'] = ctime data['expire_date'] = expire_date data['is_expired'] = fileshare.is_expired() - + data['permissions'] = fileshare.get_permissions() return data class ShareLinks(APIView): @@ -91,6 +91,36 @@ class ShareLinks(APIView): return (None, None) + def _check_permissions_arg(self, request): + permissions = request.data.get('permissions', None) + if permissions is not None: + if isinstance(permissions, dict): + perm_dict = permissions + elif isinstance(permissions, basestring): + import json + try: + perm_dict = json.loads(permissions) + except ValueError: + error_msg = 'permissions invalid: %s' % permissions + return api_error(status.HTTP_400_BAD_REQUEST, error_msg) + else: + error_msg = 'permissions invalid: %s' % permissions + return api_error(status.HTTP_400_BAD_REQUEST, error_msg) + else: + perm_dict = None + + can_preview = True + can_download = True + if perm_dict is not None: + can_preview = perm_dict.get('can_preview', True) + can_download = perm_dict.get('can_download', True) + + if can_preview and can_download: + perm = FileShare.PERM_VIEW_DL + if can_preview and not can_download: + perm = FileShare.PERM_VIEW_ONLY + return perm + def get(self, request): """ Get all share links of a user. @@ -188,6 +218,8 @@ class ShareLinks(APIView): else: expire_date = timezone.now() + relativedelta(days=expire_days) + perm = self._check_permissions_arg(request) + # resource check repo = seafile_api.get_repo(repo_id) if not repo: @@ -221,13 +253,15 @@ class ShareLinks(APIView): fs = FileShare.objects.get_file_link_by_path(username, repo_id, path) if not fs: fs = FileShare.objects.create_file_link(username, repo_id, path, - password, expire_date) + password, expire_date, + permission=perm) elif s_type == 'd': fs = FileShare.objects.get_dir_link_by_path(username, repo_id, path) if not fs: fs = FileShare.objects.create_dir_link(username, repo_id, path, - password, expire_date) + password, expire_date, + permission=perm) if is_org_context(request): org_id = request.user.org.org_id diff --git a/seahub/share/models.py b/seahub/share/models.py index 1b248ab5f2..27e8e46a4b 100644 --- a/seahub/share/models.py +++ b/seahub/share/models.py @@ -201,6 +201,19 @@ class FileShare(models.Model): else: return '%s/d/%s/' % (service_url, self.token) + def get_permissions(self): + perm_dict = {} + if self.permission == FileShare.PERM_VIEW_DL: + perm_dict['can_preview'] = True + perm_dict['can_download'] = True + elif self.permission == FileShare.PERM_VIEW_ONLY: + perm_dict['can_preview'] = True + perm_dict['can_download'] = False + else: + assert False + return perm_dict + + class OrgFileShareManager(models.Manager): def set_org_file_share(self, org_id, file_share): """Set a share link as org share link. diff --git a/tests/api/endpoints/test_share_links.py b/tests/api/endpoints/test_share_links.py index 1750f5b0be..a5e616e30c 100644 --- a/tests/api/endpoints/test_share_links.py +++ b/tests/api/endpoints/test_share_links.py @@ -103,6 +103,81 @@ class ShareLinksTest(BaseTestCase): self._remove_share_link(json_resp['token']) + def test_create_file_share_link_with_permissions(self): + self.login_as(self.user) + + json_str = json.dumps({'path': self.file_path, 'repo_id': self.repo_id, + 'permissions': { + 'can_preview': True, + 'can_download': True + }}) + resp = self.client.post(self.url, json_str, + content_type="application/json") + self.assertEqual(200, resp.status_code) + + json_resp = json.loads(resp.content) + assert json_resp['link'] is not None + assert json_resp['token'] is not None + assert json_resp['is_expired'] is not None + + assert json_resp['token'] in json_resp['link'] + assert 'f' in json_resp['link'] + + assert json_resp['permissions']['can_preview'] is True + assert json_resp['permissions']['can_download'] is True + + self._remove_share_link(json_resp['token']) + + def test_create_file_share_link_with_invalid_permissions(self): + self.login_as(self.user) + + json_str = json.dumps({'path': self.file_path, 'repo_id': self.repo_id, + 'permissions': { + 'can_previewxxx': True, + 'can_downloadyyy': False + }}) + resp = self.client.post(self.url, json_str, + content_type="application/json") + self.assertEqual(200, resp.status_code) + + json_resp = json.loads(resp.content) + assert json_resp['link'] is not None + assert json_resp['token'] is not None + assert json_resp['is_expired'] is not None + + assert json_resp['token'] in json_resp['link'] + assert 'f' in json_resp['link'] + + assert json_resp['permissions']['can_preview'] is True + assert json_resp['permissions']['can_download'] is True + + self._remove_share_link(json_resp['token']) + + def test_create_file_share_link_with_view_only_permission(self): + self.login_as(self.user) + + json_str = json.dumps({'path': self.file_path, 'repo_id': self.repo_id, + 'permissions': { + 'can_preview': True, + 'can_download': False + }}) + resp = self.client.post(self.url, json_str, + content_type="application/json") + self.assertEqual(200, resp.status_code) + + json_resp = json.loads(resp.content) + assert json_resp['link'] is not None + assert json_resp['token'] is not None + assert json_resp['is_expired'] is not None + + assert json_resp['token'] in json_resp['link'] + assert 'f' in json_resp['link'] + + assert json_resp['permissions']['can_preview'] is True + assert json_resp['permissions']['can_download'] is False + + self._remove_share_link(json_resp['token']) + def test_create_dir_share_link(self): self.login_as(self.user) From 18f07648188b7fd63c26d3ba022cfafe78396e13 Mon Sep 17 00:00:00 2001 From: llj Date: Mon, 22 May 2017 17:20:42 +0800 Subject: [PATCH 2/3] [share link] modification about permissions --- seahub/templates/js/templates.html | 10 ++++++ seahub/templates/shared_file_view.html | 32 ++++++++++++++++++- .../templates/snippets/file_share_popup.html | 9 ++++++ seahub/templates/snippets/shared_link_js.html | 11 ++++++- seahub/templates/view_shared_dir.html | 15 +++++---- seahub/views/file.py | 3 ++ seahub/views/repo.py | 3 ++ static/scripts/app/views/share.js | 22 +++++++++++-- 8 files changed, 94 insertions(+), 11 deletions(-) diff --git a/seahub/templates/js/templates.html b/seahub/templates/js/templates.html index 3abd40ac7a..b89a148945 100644 --- a/seahub/templates/js/templates.html +++ b/seahub/templates/js/templates.html @@ -699,6 +699,7 @@ <% if (!repo_encrypted && can_generate_share_link) { %> +