7x31
/
cmdb
mirror of https://github.com/veops/cmdb.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #529 from veops/fix_decorator_perms_role_required 

fix: decorator_perms_role_required
This commit is contained in:
simontigers 2024-06-04 19:23:58 +08:00 committed by GitHub
parent 78495eb976 27354a3927
commit 491d3cce00
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
cmdb-api/api/lib/common_setting/decorator.py
View File

@ -3,6 +3,7 @@ import functools
from flask import abort, session from flask import abort, session
from api.lib.common_setting.acl import ACLManager from api.lib.common_setting.acl import ACLManager
from api.lib.common_setting.resp_format import ErrFormat from api.lib.common_setting.resp_format import ErrFormat
from api.lib.perm.acl.acl import is_app_admin
def perms_role_required(app_name, resource_type_name, resource_name, perm, role_name=None): def perms_role_required(app_name, resource_type_name, resource_name, perm, role_name=None):
@ -16,7 +17,7 @@ def perms_role_required(app_name, resource_type_name, resource_name, perm, role_
except Exception as e: except Exception as e:
# resource_type not exist, continue check role # resource_type not exist, continue check role
if role_name: if role_name:
if role_name not in session.get("acl", {}).get("parentRoles", []): if role_name not in session.get("acl", {}).get("parentRoles", []) and not is_app_admin(app_name):
abort(403, ErrFormat.role_required.format(role_name)) abort(403, ErrFormat.role_required.format(role_name))
return func(*args, **kwargs) return func(*args, **kwargs)
@ -25,7 +26,7 @@ def perms_role_required(app_name, resource_type_name, resource_name, perm, role_
if not has_perms: if not has_perms:
if role_name: if role_name:
if role_name not in session.get("acl", {}).get("parentRoles", []): if role_name not in session.get("acl", {}).get("parentRoles", []) and not is_app_admin(app_name):
abort(403, ErrFormat.role_required.format(role_name)) abort(403, ErrFormat.role_required.format(role_name))
else: else:
abort(403, ErrFormat.resource_no_permission.format(resource_name, perm)) abort(403, ErrFormat.resource_no_permission.format(resource_name, perm))