Invario/Inventarsystem
3
1
Fork 0
Code Issues 29 Pull Requests Actions Packages Projects Releases 216 Wiki Activity

Merge remote-tracking branch 'origin/main'
Release Inventarsystem / release-docker (push) Successful in 2m18s
Details

Browse Source
This commit is contained in:
AIIrondev
2026-08-14 20:35:44 +02:00
parent 9fb56e905c 21ad639081
commit 440cafb88f
2 changed files with 31 additions and 34 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Web/app.py
+5 -7
View File
@@ -453,7 +453,7 @@ PERMISSION_ACTION_ENDPOINTS = {
'admin_reset_user_password': 'can_manage_users', 'admin_reset_user_password': 'can_manage_users',
'admin_update_user_permissions': 'can_manage_users', 'admin_update_user_permissions': 'can_manage_users',
'admin_anonymize_names': 'can_manage_users', 'admin_anonymize_names': 'can_manage_users',
'home_admin': 'can_manage_settings', 'home_admin': 'can_borrow',
'upload_admin': 'can_insert', 'upload_admin': 'can_insert',
'library_admin': 'can_insert', 'library_admin': 'can_insert',
'admin_borrowings': 'can_manage_settings', 'admin_borrowings': 'can_manage_settings',
@@ -811,6 +811,8 @@ def _page_access_allowed(permissions, endpoint):
if not permissions or not endpoint: if not permissions or not endpoint:
return True return True
page_permissions = permissions.get('pages', {}) page_permissions = permissions.get('pages', {})
if endpoint == "home_admin":
return True
return bool(page_permissions.get(endpoint, True)) return bool(page_permissions.get(endpoint, True))
@@ -823,14 +825,10 @@ def _action_access_allowed(permissions, action_key):
def _permission_denied_fallback_endpoint(permissions, current_endpoint=None): def _permission_denied_fallback_endpoint(permissions, current_endpoint=None):
username = session.get('username') username = session.get('username')
is_admin_user = bool(username and us.check_admin(username))
admin_home_allowed = _page_access_allowed(permissions, 'home_admin') and _action_access_allowed(permissions, 'can_manage_settings')
for candidate in ('my_borrowed_items', 'tutorial_page', 'notifications_view', 'impressum', 'home_admin'): for candidate in ('home_admin', 'my_borrowed_items', 'tutorial_page', 'notifications_view', 'impressum'):
if current_endpoint and candidate == current_endpoint: if current_endpoint and candidate == current_endpoint:
continue continue
if candidate == 'home_admin' and is_admin_user and not admin_home_allowed:
continue
if _page_access_allowed(permissions, candidate): if _page_access_allowed(permissions, candidate):
return candidate return candidate
return 'logout' return 'logout'
@@ -8011,7 +8009,7 @@ def user_del():
fullname = None fullname = None
users_list.append({ users_list.append({
'username': username, # Username ist plain in DB, kein decrypt_text() notwendig 'username': decrypt_text(username),
'admin': user.get('Admin', False), 'admin': user.get('Admin', False),
'fullname': fullname, 'fullname': fullname,
'name': name, 'name': name,
Web/modules/database/user.py
+26 -27
View File
@@ -211,6 +211,7 @@ PERMISSION_PRESETS = {
}, },
'pages': { 'pages': {
'home': True, 'home': True,
'home_admin': True,
'tutorial_page': True, 'tutorial_page': True,
'my_borrowed_items': True, 'my_borrowed_items': True,
'notifications_view': True, 'notifications_view': True,
@@ -369,10 +370,10 @@ def update_user_permissions(username, preset_key, action_permissions=None, page_
client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT) client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
db = _get_tenant_db(client) db = _get_tenant_db(client)
users = db['users'] users = db['users']
result = users.update_one({'Username': dp.encrypt_text(username)}, {'$set': update_data}) result = users.update_one({'Username': username}, {'$set': update_data})
if result.matched_count == 0: if result.matched_count == 0:
result = users.update_one({'username': dp.encrypt_text(username)}, {'$set': update_data}) result = users.update_one({'username': username}, {'$set': update_data})
client.close() client.close()
return result.matched_count > 0 return result.matched_count > 0
@@ -384,7 +385,7 @@ def get_favorites(username):
client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT) client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
db = _get_tenant_db(client) db = _get_tenant_db(client)
users = db['users'] users = db['users']
user = users.find_one({'Username': dp.encrypt_text(username)}) or users.find_one({'username': dp.encrypt_text(username)}) user = users.find_one({'Username': username}) or users.find_one({'username': username})
client.close() client.close()
if not user: if not user:
return [] return []
@@ -399,7 +400,7 @@ def add_favorite(username, item_id):
db = _get_tenant_db(client) db = _get_tenant_db(client)
users = db['users'] users = db['users']
users.update_one( users.update_one(
{'$or': [{'Username': dp.encrypt_text(username)}, {'username': dp.encrypt_text(username)}]}, {'$or': [{'Username': username}, {'username': username}]},
{'$addToSet': {'favorites': ObjectId(item_id)}} {'$addToSet': {'favorites': ObjectId(item_id)}}
) )
client.close() client.close()
@@ -414,7 +415,7 @@ def remove_favorite(username, item_id):
db = _get_tenant_db(client) db = _get_tenant_db(client)
users = db['users'] users = db['users']
users.update_one( users.update_one(
{'$or': [{'Username': dp.encrypt_text(username)}, {'username': dp.encrypt_text(username)}]}, {'$or': [{'Username': username}, {'username': username}]},
{'$pull': {'favorites': ObjectId(item_id)}} {'$pull': {'favorites': ObjectId(item_id)}}
) )
client.close() client.close()
@@ -496,7 +497,7 @@ def check_nm_pwd(username, password):
db = client[db_name] db = client[db_name]
users = db['users'] users = db['users']
query = {'$or': [{'Username': dp.encrypt_text(username)}, {'username': dp.encrypt_text(username)}]} query = {'$or': [{'Username': username}, {'username': username}]}
user_record = users.find_one(query) user_record = users.find_one(query)
if user_record is None: if user_record is None:
@@ -507,8 +508,6 @@ def check_nm_pwd(username, password):
default_users = client[cfg.MONGODB_DB]['users'] default_users = client[cfg.MONGODB_DB]['users']
user_record_fallback = default_users.find_one( user_record_fallback = default_users.find_one(
{'$or': [ {'$or': [
{'Username': dp.encrypt_text(username)},
{'username': dp.encrypt_text(username)},
{'Username': username}, {'Username': username},
{'username': username}, {'username': username},
]} ]}
@@ -711,9 +710,9 @@ def make_admin(username):
client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT) client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
db = _get_tenant_db(client) db = _get_tenant_db(client)
users = db['users'] users = db['users']
result = users.update_one({'Username': dp.encrypt_text(username)}, {'$set': {'Admin': True}}) result = users.update_one({'Username': username}, {'$set': {'Admin': True}})
if result.matched_count == 0: if result.matched_count == 0:
result = users.update_one({'username': dp.encrypt_text(username)}, {'$set': {'Admin': True}}) result = users.update_one({'username': username}, {'$set': {'Admin': True}})
client.close() client.close()
return result.matched_count > 0 return result.matched_count > 0
@@ -723,9 +722,9 @@ def remove_admin(username):
client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT) client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
db = _get_tenant_db(client) db = _get_tenant_db(client)
users = db['users'] users = db['users']
result = users.update_one({'Username': dp.encrypt_text(username)}, {'$set': {'Admin': False}}) result = users.update_one({'Username': username}, {'$set': {'Admin': False}})
if result.matched_count == 0: if result.matched_count == 0:
result = users.update_one({'username': dp.encrypt_text(username)}, {'$set': {'Admin': False}}) result = users.update_one({'username': username}, {'$set': {'Admin': False}})
client.close() client.close()
return result.matched_count > 0 return result.matched_count > 0
@@ -737,7 +736,7 @@ def get_user(username):
def find_in_db(database_name): def find_in_db(database_name):
db = client[database_name] db = client[database_name]
users = db['users'] users = db['users']
return users.find_one({'Username': dp.encrypt_text(username)}) or users.find_one({'username': dp.encrypt_text(username)}) or users.find_one({'username': username}) or users.find_one({'Username': username}) return users.find_one({'Username': username}) or users.find_one({'username': username}) or users.find_one({'username': username}) or users.find_one({'Username': username})
tenant_db, tenant_id = _resolve_request_tenant_db() tenant_db, tenant_id = _resolve_request_tenant_db()
if tenant_db: if tenant_db:
@@ -773,12 +772,12 @@ def update_active_ausleihung(username, id_item, ausleihung):
users = db['users'] users = db['users']
result = users.update_one( result = users.update_one(
{'Username': dp.encrypt_text(username)}, {'Username': username},
{'$set': {'active_ausleihung': {'Item': id_item, 'Ausleihung': ausleihung}}} {'$set': {'active_ausleihung': {'Item': id_item, 'Ausleihung': ausleihung}}}
) )
if result.matched_count == 0: if result.matched_count == 0:
users.update_one( users.update_one(
{'username': dp.encrypt_text(username)}, {'username': username},
{'$set': {'active_ausleihung': {'Item': id_item, 'Ausleihung': ausleihung}}} {'$set': {'active_ausleihung': {'Item': id_item, 'Ausleihung': ausleihung}}}
) )
client.close() client.close()
@@ -791,7 +790,7 @@ def get_active_ausleihung(username):
db = _get_tenant_db(client) db = _get_tenant_db(client)
users = db['users'] users = db['users']
user = users.find_one({'Username': dp.encrypt_text(username)}) or users.find_one({'username': dp.encrypt_text(username)}) user = users.find_one({'Username': username}) or users.find_one({'username': username})
client.close() client.close()
if not user: if not user:
@@ -806,7 +805,7 @@ def has_active_borrowing(username):
db = _get_tenant_db(client) db = _get_tenant_db(client)
users = db['users'] users = db['users']
user = users.find_one({'username': dp.encrypt_text(username)}) or users.find_one({'Username': dp.encrypt_text(username)}) user = users.find_one({'username': username}) or users.find_one({'Username': username})
client.close() client.close()
if not user: if not user:
@@ -823,9 +822,9 @@ def delete_user(username):
db = _get_tenant_db(client) db = _get_tenant_db(client)
users = db['users'] users = db['users']
result = users.delete_one({'username': dp.encrypt_text(username)}) result = users.delete_one({'username': username})
if result.deleted_count == 0: if result.deleted_count == 0:
result = users.delete_one({'Username': dp.encrypt_text(username)}) result = users.delete_one({'Username': username})
client.close() client.close()
return result.deleted_count > 0 return result.deleted_count > 0
@@ -840,9 +839,9 @@ def update_active_borrowing(username, item_id, status):
update_data = {'$set': {'active_borrowing': status, 'borrowed_item': item_id if status else None}} update_data = {'$set': {'active_borrowing': status, 'borrowed_item': item_id if status else None}}
result = users.update_one({'username': dp.encrypt_text(username)}, update_data) result = users.update_one({'username': username}, update_data)
if result.matched_count == 0: if result.matched_count == 0:
result = users.update_one({'Username': dp.encrypt_text(username)}, update_data) result = users.update_one({'Username': username}, update_data)
client.close() client.close()
return result.modified_count > 0 return result.modified_count > 0
@@ -856,7 +855,7 @@ def get_name(username):
db = _get_tenant_db(client) db = _get_tenant_db(client)
users = db['users'] users = db['users']
user = users.find_one({'Username': dp.encrypt_text(username)}) or users.find_one({'username': dp.encrypt_text(username)}) user = users.find_one({'Username': username}) or users.find_one({'username': username})
client.close() client.close()
if not user or not user.get("name"): if not user or not user.get("name"):
@@ -871,7 +870,7 @@ def get_last_name(username):
db = _get_tenant_db(client) db = _get_tenant_db(client)
users = db['users'] users = db['users']
user = users.find_one({'Username': dp.encrypt_text(username)}) or users.find_one({'username': dp.encrypt_text(username)}) user = users.find_one({'Username': username}) or users.find_one({'username': username})
client.close() client.close()
if not user or not user.get("last_name"): if not user or not user.get("last_name"):
@@ -906,12 +905,12 @@ def update_password(username, new_password):
hashed_password = hashing(new_password) hashed_password = hashing(new_password)
result = users.update_one( result = users.update_one(
{'Username': dp.encrypt_text(username)}, {'Username': username},
{'$set': {'Password': hashed_password}} {'$set': {'Password': hashed_password}}
) )
if result.matched_count == 0: if result.matched_count == 0:
result = users.update_one( result = users.update_one(
{'username': dp.encrypt_text(username)}, {'username': username},
{'$set': {'Password': hashed_password}} {'$set': {'Password': hashed_password}}
) )
@@ -933,12 +932,12 @@ def update_user_name(username, name, last_name):
safe_last_name = dp.encrypt_text(last_name.strip()) if last_name else '' safe_last_name = dp.encrypt_text(last_name.strip()) if last_name else ''
result = users.update_one( result = users.update_one(
{'Username': dp.encrypt_text(username)}, {'Username': username},
{'$set': {'name': safe_name, 'last_name': safe_last_name}} {'$set': {'name': safe_name, 'last_name': safe_last_name}}
) )
if result.matched_count == 0: if result.matched_count == 0:
result = users.update_one( result = users.update_one(
{'username': dp.encrypt_text(username)}, {'username': username},
{'$set': {'name': safe_name, 'last_name': safe_last_name}} {'$set': {'name': safe_name, 'last_name': safe_last_name}}
) )