From 5abbb842543b0bf48cf7a4d361c8f0b4522df27c Mon Sep 17 00:00:00 2001
From: Yohann D'ANELLO <yohann.danello@gmail.com>
Date: Sat, 15 Aug 2020 22:24:48 +0200
Subject: [PATCH] Permissions for activities must be more specific to prevent
that anyone can validate its own activity
---
apps/permission/fixtures/initial.json | 166 ++++++++++++++++++++++----
1 file changed, 146 insertions(+), 20 deletions(-)
diff --git a/apps/permission/fixtures/initial.json b/apps/permission/fixtures/initial.json
index 192b9391..4a48dd83 100644
--- a/apps/permission/fixtures/initial.json
+++ b/apps/permission/fixtures/initial.json
@@ -551,22 +551,6 @@
"description": "Voir toutes les activités valides"
}
},
- {
- "model": "permission.permission",
- "pk": 35,
- "fields": {
- "model": [
- "activity",
- "activity"
- ],
- "query": "[\"AND\", {\"valid\": false}, {\"creater\": [\"user\"]}]",
- "type": "change",
- "mask": 1,
- "field": "",
- "permanent": false,
- "description": "Modifier les activités non validées dont on est l'auteur"
- }
- },
{
"model": "permission.permission",
"pk": 36,
@@ -2375,6 +2359,134 @@
"description": "Supprimer une facture"
}
},
+ {
+ "model": "permission.permission",
+ "pk": 152,
+ "fields": {
+ "model": [
+ "activity",
+ "activity"
+ ],
+ "query": "[\"AND\", {\"valid\": false}, {\"creater\": [\"user\"]}]",
+ "type": "change",
+ "mask": 1,
+ "field": "name",
+ "permanent": false,
+ "description": "Modifier le nom d'une activité non validée dont on est l'auteur"
+ }
+ },
+ {
+ "model": "permission.permission",
+ "pk": 153,
+ "fields": {
+ "model": [
+ "activity",
+ "activity"
+ ],
+ "query": "[\"AND\", {\"valid\": false}, {\"creater\": [\"user\"]}]",
+ "type": "change",
+ "mask": 1,
+ "field": "description",
+ "permanent": false,
+ "description": "Modifier la description d'une activité non validée dont on est l'auteur"
+ }
+ },
+ {
+ "model": "permission.permission",
+ "pk": 154,
+ "fields": {
+ "model": [
+ "activity",
+ "activity"
+ ],
+ "query": "[\"AND\", {\"valid\": false}, {\"creater\": [\"user\"]}]",
+ "type": "change",
+ "mask": 1,
+ "field": "location",
+ "permanent": false,
+ "description": "Modifier le lieu d'une activité non validée dont on est l'auteur"
+ }
+ },
+ {
+ "model": "permission.permission",
+ "pk": 155,
+ "fields": {
+ "model": [
+ "activity",
+ "activity"
+ ],
+ "query": "[\"AND\", {\"valid\": false}, {\"creater\": [\"user\"]}]",
+ "type": "change",
+ "mask": 1,
+ "field": "activity_type",
+ "permanent": false,
+ "description": "Modifier le type d'une activité non validée dont on est l'auteur"
+ }
+ },
+ {
+ "model": "permission.permission",
+ "pk": 156,
+ "fields": {
+ "model": [
+ "activity",
+ "activity"
+ ],
+ "query": "[\"AND\", {\"valid\": false}, {\"creater\": [\"user\"]}]",
+ "type": "organizer",
+ "mask": 1,
+ "field": "name",
+ "permanent": false,
+ "description": "Modifier l'organisateur d'une activité non validée dont on est l'auteur"
+ }
+ },
+ {
+ "model": "permission.permission",
+ "pk": 157,
+ "fields": {
+ "model": [
+ "activity",
+ "activity"
+ ],
+ "query": "[\"AND\", {\"valid\": false}, {\"creater\": [\"user\"]}]",
+ "type": "change",
+ "mask": 1,
+ "field": "attendees_club",
+ "permanent": false,
+ "description": "Modifier le club attendu d'une activité non validée dont on est l'auteur"
+ }
+ },
+ {
+ "model": "permission.permission",
+ "pk": 158,
+ "fields": {
+ "model": [
+ "activity",
+ "activity"
+ ],
+ "query": "[\"AND\", {\"valid\": false}, {\"creater\": [\"user\"]}]",
+ "type": "change",
+ "mask": 1,
+ "field": "date_start",
+ "permanent": false,
+ "description": "Modifier la date de début d'une activité non validée dont on est l'auteur"
+ }
+ },
+ {
+ "model": "permission.permission",
+ "pk": 159,
+ "fields": {
+ "model": [
+ "activity",
+ "activity"
+ ],
+ "query": "[\"AND\", {\"valid\": false}, {\"creater\": [\"user\"]}]",
+ "type": "change",
+ "mask": 1,
+ "field": "date_end",
+ "permanent": false,
+ "description": "Modifier la date de fin d'une activité non validée dont on est l'auteur"
+ }
+ },
{
"model": "permission.role",
"pk": 1,
@@ -2409,7 +2521,6 @@
"name": "Adh\u00e9rent Kfet",
"permissions": [
34,
- 35,
36,
6,
39,
@@ -2431,7 +2542,15 @@
101,
108,
109,
- 144
+ 144,
+ 152,
+ 153,
+ 154,
+ 155,
+ 156,
+ 157,
+ 158,
+ 159
]
}
},
@@ -2600,7 +2719,6 @@
32,
33,
34,
- 35,
36,
37,
38,
@@ -2713,7 +2831,15 @@
148,
149,
150,
- 151
+ 151,
+ 152,
+ 153,
+ 154,
+ 155,
+ 156,
+ 157,
+ 158,
+ 159
]
}
},
--
GitLab