GNOME Bugzilla – Bug 614814
[security] When browsing anonymously, non-public notebook names should not be visible
Last modified: 2010-08-07 04:09:09 UTC
The sidebar shows all notebook names at the bottom, even if the current user does not have access to notes in those notebooks.
Created attachment 167082 [details] [review] fix Simple fix that adds a function which can easily be expanded in the future and a property which uses that function. Also in the bugs/public-notebooks branch in my github: http://github.com/SEJeff/snowy/commit/370bb92e1dc944637aedc602087f1d2a0da9c40c
Review of attachment 167082 [details] [review]: Found a bug in this patch. It filters notebooks with 0 public notes when logged in as the author.
Created attachment 167086 [details] [review] Proper fix The logic is something like: if NoteBooks.is_public or if NoteBook.author == request.user: show_notebook_in_sidebar() django 1.2's smarter if tags obsolete the ifequal nastiness: http://docs.djangoproject.com/en/1.2/releases/1.2/#new-in-1-2-smart-if
And new github commit: http://github.com/SEJeff/snowy/commit/2ccfba7ba782fb393d5c4e1bf9395a4a8917f7b6
Review of attachment 167086 [details] [review]: ::: notes/models.py @@ +91,3 @@ + # This will need to be expanded once a more + # fine-grained permissions system is in place. + if filter(lambda note: note.permissions, self.note_set.all() ): Hmm, this is going to have *ugly* performance implications. Can you make this happen in a query, e.g.: if self.note_set.all().filter(note__permissions_gt=0).count(): or somesuch?
Created attachment 167156 [details] [review] Version 3 of the patch This patch addresses brad's comment, adds the check to note_index.html as well, and separates out the shared template code to _display_notebooks.html.
Review of attachment 167156 [details] [review]: In general, looks good. Just one small nitpick: ::: notes/templates/notes/_display_notebooks.html @@ +1,1 @@ +{% comment %}In the spirit of D.R.Y.{% endcomment %} Let's name this file notebook_list_snippet.html to be similar to note_list_snippet.html.
Created attachment 167228 [details] [review] Same thing v4 Round 4, fight!
Review of attachment 167228 [details] [review]: Disregard and sorry for bugspam.
Created attachment 167229 [details] [review] v5 Hopefully this is the final iteration
Review of attachment 167229 [details] [review]: Make it so.
pushed in 437f26720d647e