From 68596b69396ab02b9caa88ca37bca5c049229116 Mon Sep 17 00:00:00 2001 From: Aiirondev Date: Fri, 24 Jul 2026 18:59:29 +0200 Subject: [PATCH] changes to fix the user authentification issues --- Web/app.py | 6 +- Web/modules/database/user.py | 10 +- Web/templates/base.html | 243 +++++++++++++++++++++++++---------- 3 files changed, 185 insertions(+), 74 deletions(-) diff --git a/Web/app.py b/Web/app.py index 1e2cafd..8cf0f23 100755 --- a/Web/app.py +++ b/Web/app.py @@ -1258,7 +1258,9 @@ def inject_version(): try: client = MongoClient(MONGODB_HOST, MONGODB_PORT) db = client[MONGODB_DB] - unread_notification_count = _get_unread_notification_count(db, session['username'], is_admin=is_admin) + # Pass the computed permission instead of the strict is_admin boolean + can_manage = current_permissions.get('actions', {}).get('can_manage_settings', False) + unread_notification_count = _get_unread_notification_count(db, session['username'], is_admin=(is_admin or can_manage)) except Exception: unread_notification_count = 0 finally: @@ -7888,7 +7890,7 @@ def register(): page_permissions = {} for endpoint_name, _ in PERMISSION_PAGE_OPTIONS: page_permissions[endpoint_name] = request.form.get(f'page_{endpoint_name}') == 'on' - + us.add_user( username, password, diff --git a/Web/modules/database/user.py b/Web/modules/database/user.py index ff3b227..b3e8643 100755 --- a/Web/modules/database/user.py +++ b/Web/modules/database/user.py @@ -323,7 +323,8 @@ def get_effective_permissions(username): if bool(user.get('Admin', False)): return build_default_permission_payload('full_access') - preset_key = user.get('PermissionPreset') or 'standard_user' + preset_key = user.get('PermissionPreset') + print(preset_key) payload = build_default_permission_payload(preset_key) payload['actions'] = _normalize_bool_map(user.get('ActionPermissions', {}), payload['actions']) payload['pages'] = _normalize_bool_map(user.get('PagePermissions', {}), payload['pages']) @@ -552,10 +553,15 @@ def add_user( for key, value in page_permissions.items(): permission_defaults['pages'][str(key)] = bool(value) + if permission_preset == "full_access": + can_admin_preset_based = True + else: + can_admin_preset_based = False + user_doc = { 'Username': username, 'Password': hashing(password), - 'Admin': False, + 'Admin': can_admin_preset_based, 'active_ausleihung': None, 'name': name.strip() if name else '', 'last_name': last_name.strip() if last_name else '', diff --git a/Web/templates/base.html b/Web/templates/base.html index 636b306..9c733bb 100755 --- a/Web/templates/base.html +++ b/Web/templates/base.html @@ -1130,7 +1130,7 @@
  • Kalender
    • - {% if current_permissions.pages.get('terminplan', True) and current_permissions.actions.get('can_insert', True) %} + {% if current_permissions.pages.get('terminplan', False) and current_permissions.actions.get('can_insert', False) %}
  • Neue Planung
    • @@ -1145,20 +1145,22 @@