diff --git a/Web/app.py b/Web/app.py index 29df6fa..13463e2 100755 --- a/Web/app.py +++ b/Web/app.py @@ -453,7 +453,7 @@ PERMISSION_ACTION_ENDPOINTS = { 'admin_reset_user_password': 'can_manage_users', 'admin_update_user_permissions': 'can_manage_users', 'admin_anonymize_names': 'can_manage_users', - 'home_admin': 'can_manage_settings', + 'home_admin': 'can_borrow', 'upload_admin': 'can_insert', 'library_admin': 'can_insert', 'admin_borrowings': 'can_manage_settings', @@ -811,6 +811,8 @@ def _page_access_allowed(permissions, endpoint): if not permissions or not endpoint: return True page_permissions = permissions.get('pages', {}) + if endpoint == "home_admin": + return True return bool(page_permissions.get(endpoint, True)) @@ -823,14 +825,10 @@ def _action_access_allowed(permissions, action_key): def _permission_denied_fallback_endpoint(permissions, current_endpoint=None): username = session.get('username') - is_admin_user = bool(username and us.check_admin(username)) - admin_home_allowed = _page_access_allowed(permissions, 'home_admin') and _action_access_allowed(permissions, 'can_manage_settings') - for candidate in ('my_borrowed_items', 'tutorial_page', 'notifications_view', 'impressum', 'home_admin'): + for candidate in ('home_admin', 'my_borrowed_items', 'tutorial_page', 'notifications_view', 'impressum'): if current_endpoint and candidate == current_endpoint: continue - if candidate == 'home_admin' and is_admin_user and not admin_home_allowed: - continue if _page_access_allowed(permissions, candidate): return candidate return 'logout' @@ -8011,7 +8009,7 @@ def user_del(): fullname = None users_list.append({ - 'username': username, # Username ist plain in DB, kein decrypt_text() notwendig + 'username': decrypt_text(username), 'admin': user.get('Admin', False), 'fullname': fullname, 'name': name, diff --git a/Web/modules/database/user.py b/Web/modules/database/user.py index 2ccbb07..3091ed9 100755 --- a/Web/modules/database/user.py +++ b/Web/modules/database/user.py @@ -211,6 +211,7 @@ PERMISSION_PRESETS = { }, 'pages': { 'home': True, + 'home_admin': True, 'tutorial_page': True, 'my_borrowed_items': True, 'notifications_view': True, @@ -369,10 +370,10 @@ def update_user_permissions(username, preset_key, action_permissions=None, page_ client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT) db = _get_tenant_db(client) users = db['users'] - result = users.update_one({'Username': dp.encrypt_text(username)}, {'$set': update_data}) + result = users.update_one({'Username': username}, {'$set': update_data}) if result.matched_count == 0: - result = users.update_one({'username': dp.encrypt_text(username)}, {'$set': update_data}) + result = users.update_one({'username': username}, {'$set': update_data}) client.close() return result.matched_count > 0 @@ -384,7 +385,7 @@ def get_favorites(username): client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT) db = _get_tenant_db(client) users = db['users'] - user = users.find_one({'Username': dp.encrypt_text(username)}) or users.find_one({'username': dp.encrypt_text(username)}) + user = users.find_one({'Username': username}) or users.find_one({'username': username}) client.close() if not user: return [] @@ -399,7 +400,7 @@ def add_favorite(username, item_id): db = _get_tenant_db(client) users = db['users'] users.update_one( - {'$or': [{'Username': dp.encrypt_text(username)}, {'username': dp.encrypt_text(username)}]}, + {'$or': [{'Username': username}, {'username': username}]}, {'$addToSet': {'favorites': ObjectId(item_id)}} ) client.close() @@ -414,7 +415,7 @@ def remove_favorite(username, item_id): db = _get_tenant_db(client) users = db['users'] users.update_one( - {'$or': [{'Username': dp.encrypt_text(username)}, {'username': dp.encrypt_text(username)}]}, + {'$or': [{'Username': username}, {'username': username}]}, {'$pull': {'favorites': ObjectId(item_id)}} ) client.close() @@ -496,7 +497,7 @@ def check_nm_pwd(username, password): db = client[db_name] users = db['users'] - query = {'$or': [{'Username': dp.encrypt_text(username)}, {'username': dp.encrypt_text(username)}]} + query = {'$or': [{'Username': username}, {'username': username}]} user_record = users.find_one(query) if user_record is None: @@ -507,8 +508,6 @@ def check_nm_pwd(username, password): default_users = client[cfg.MONGODB_DB]['users'] user_record_fallback = default_users.find_one( {'$or': [ - {'Username': dp.encrypt_text(username)}, - {'username': dp.encrypt_text(username)}, {'Username': username}, {'username': username}, ]} @@ -711,9 +710,9 @@ def make_admin(username): client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT) db = _get_tenant_db(client) users = db['users'] - result = users.update_one({'Username': dp.encrypt_text(username)}, {'$set': {'Admin': True}}) + result = users.update_one({'Username': username}, {'$set': {'Admin': True}}) if result.matched_count == 0: - result = users.update_one({'username': dp.encrypt_text(username)}, {'$set': {'Admin': True}}) + result = users.update_one({'username': username}, {'$set': {'Admin': True}}) client.close() return result.matched_count > 0 @@ -723,9 +722,9 @@ def remove_admin(username): client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT) db = _get_tenant_db(client) users = db['users'] - result = users.update_one({'Username': dp.encrypt_text(username)}, {'$set': {'Admin': False}}) + result = users.update_one({'Username': username}, {'$set': {'Admin': False}}) if result.matched_count == 0: - result = users.update_one({'username': dp.encrypt_text(username)}, {'$set': {'Admin': False}}) + result = users.update_one({'username': username}, {'$set': {'Admin': False}}) client.close() return result.matched_count > 0 @@ -737,7 +736,7 @@ def get_user(username): def find_in_db(database_name): db = client[database_name] users = db['users'] - return users.find_one({'Username': dp.encrypt_text(username)}) or users.find_one({'username': dp.encrypt_text(username)}) or users.find_one({'username': username}) or users.find_one({'Username': username}) + return users.find_one({'Username': username}) or users.find_one({'username': username}) or users.find_one({'username': username}) or users.find_one({'Username': username}) tenant_db, tenant_id = _resolve_request_tenant_db() if tenant_db: @@ -773,12 +772,12 @@ def update_active_ausleihung(username, id_item, ausleihung): users = db['users'] result = users.update_one( - {'Username': dp.encrypt_text(username)}, + {'Username': username}, {'$set': {'active_ausleihung': {'Item': id_item, 'Ausleihung': ausleihung}}} ) if result.matched_count == 0: users.update_one( - {'username': dp.encrypt_text(username)}, + {'username': username}, {'$set': {'active_ausleihung': {'Item': id_item, 'Ausleihung': ausleihung}}} ) client.close() @@ -791,7 +790,7 @@ def get_active_ausleihung(username): db = _get_tenant_db(client) users = db['users'] - user = users.find_one({'Username': dp.encrypt_text(username)}) or users.find_one({'username': dp.encrypt_text(username)}) + user = users.find_one({'Username': username}) or users.find_one({'username': username}) client.close() if not user: @@ -806,7 +805,7 @@ def has_active_borrowing(username): db = _get_tenant_db(client) users = db['users'] - user = users.find_one({'username': dp.encrypt_text(username)}) or users.find_one({'Username': dp.encrypt_text(username)}) + user = users.find_one({'username': username}) or users.find_one({'Username': username}) client.close() if not user: @@ -823,9 +822,9 @@ def delete_user(username): db = _get_tenant_db(client) users = db['users'] - result = users.delete_one({'username': dp.encrypt_text(username)}) + result = users.delete_one({'username': username}) if result.deleted_count == 0: - result = users.delete_one({'Username': dp.encrypt_text(username)}) + result = users.delete_one({'Username': username}) client.close() return result.deleted_count > 0 @@ -840,9 +839,9 @@ def update_active_borrowing(username, item_id, status): update_data = {'$set': {'active_borrowing': status, 'borrowed_item': item_id if status else None}} - result = users.update_one({'username': dp.encrypt_text(username)}, update_data) + result = users.update_one({'username': username}, update_data) if result.matched_count == 0: - result = users.update_one({'Username': dp.encrypt_text(username)}, update_data) + result = users.update_one({'Username': username}, update_data) client.close() return result.modified_count > 0 @@ -856,7 +855,7 @@ def get_name(username): db = _get_tenant_db(client) users = db['users'] - user = users.find_one({'Username': dp.encrypt_text(username)}) or users.find_one({'username': dp.encrypt_text(username)}) + user = users.find_one({'Username': username}) or users.find_one({'username': username}) client.close() if not user or not user.get("name"): @@ -871,7 +870,7 @@ def get_last_name(username): db = _get_tenant_db(client) users = db['users'] - user = users.find_one({'Username': dp.encrypt_text(username)}) or users.find_one({'username': dp.encrypt_text(username)}) + user = users.find_one({'Username': username}) or users.find_one({'username': username}) client.close() if not user or not user.get("last_name"): @@ -906,12 +905,12 @@ def update_password(username, new_password): hashed_password = hashing(new_password) result = users.update_one( - {'Username': dp.encrypt_text(username)}, + {'Username': username}, {'$set': {'Password': hashed_password}} ) if result.matched_count == 0: result = users.update_one( - {'username': dp.encrypt_text(username)}, + {'username': username}, {'$set': {'Password': hashed_password}} ) @@ -933,12 +932,12 @@ def update_user_name(username, name, last_name): safe_last_name = dp.encrypt_text(last_name.strip()) if last_name else '' result = users.update_one( - {'Username': dp.encrypt_text(username)}, + {'Username': username}, {'$set': {'name': safe_name, 'last_name': safe_last_name}} ) if result.matched_count == 0: result = users.update_one( - {'username': dp.encrypt_text(username)}, + {'username': username}, {'$set': {'name': safe_name, 'last_name': safe_last_name}} )