Changeset 78af3d1 in OpenWorkouts-current for ow/models/workout.py

Timestamp:

Feb 9, 2019, 9:42:52 PM (5 years ago)

Author:

Borja Lopez <borja@…>

Branches:

current, feature/docs, master

Children:

56caf3d

Parents:

55470f9

Message:

Fix permissions. From now on users can see (and edit, delete, etc) their own data

File:

• ow/models/workout.py (modified) (2 diffs)

ow/models/workout.py

@@ -6 +6 @@
 import gpxpy
 from repoze.folder import Folder
-from pyramid.security import Allow, Everyone
+from pyramid.security import Allow, Deny, Everyone, ALL_PERMISSIONS
 
 from ow.utilities import (
@@ -29 +29 @@
         it (for now). If not, everybody can view it, only admins can edit it.
         """
-        # Default permissions
+        uid = self.__parent__.uid
         permissions = [
-            (Allow, Everyone, 'view'),
-            (Allow, 'group:admins', 'edit')
+            (Allow, str(uid), 'view'),
+            (Allow, str(uid), 'edit'),
+            (Allow, str(uid), 'delete'),
+            (Deny, Everyone, ALL_PERMISSIONS)
         ]
-
-        uid = getattr(self.__parent__, 'uid', None)
-        if uid is not None:
-            # Change permissions in case this workout has an owner
-            permissions = [
-                (Allow, str(uid), 'view'),
-                (Allow, str(uid), 'edit'),
-            ]
         return permissions