paul@0 | 1 | # -*- coding: iso-8859-1 -*- |
paul@0 | 2 | """ |
paul@0 | 3 | MoinMoin - Queue changes for review |
paul@0 | 4 | |
paul@0 | 5 | Queue changed pages edited by unprivileged users for review by the |
paul@0 | 6 | ApproveChanges action. |
paul@0 | 7 | |
paul@28 | 8 | @copyright: 2011, 2013 Paul Boddie <paul@boddie.org.uk> |
paul@0 | 9 | @license: GNU GPL, see COPYING for details. |
paul@0 | 10 | """ |
paul@0 | 11 | |
paul@0 | 12 | from MoinMoin.PageEditor import PageEditor |
paul@0 | 13 | from MoinMoin.events import PagePreSaveEvent, Abort |
paul@30 | 14 | from MoinMoin.security import Permissions |
paul@1 | 15 | from ApproveChangesSupport import * |
paul@0 | 16 | |
paul@30 | 17 | class SpecialPermissions(Permissions): |
paul@30 | 18 | |
paul@30 | 19 | "Permit saving of ACL-enabled comment pages." |
paul@30 | 20 | |
paul@30 | 21 | def __init__(self, user, pagename): |
paul@30 | 22 | Permissions.__init__(self, user) |
paul@30 | 23 | self.pagename = pagename |
paul@30 | 24 | |
paul@30 | 25 | def admin(self, pagename): |
paul@30 | 26 | return pagename == self.pagename |
paul@30 | 27 | |
paul@30 | 28 | write = admin |
paul@30 | 29 | |
paul@0 | 30 | def handle_presave(event): |
paul@0 | 31 | request = event.request |
paul@0 | 32 | _ = request.getText |
paul@0 | 33 | |
paul@3 | 34 | queued_changes_page = get_queued_changes_page(request) |
paul@28 | 35 | user_specific_queue = get_user_specific_queue(request) |
paul@0 | 36 | |
paul@0 | 37 | pagename = event.page_editor.page_name |
paul@4 | 38 | body = event.new_text |
paul@0 | 39 | |
paul@0 | 40 | # Saving into queues has to be permitted or the mechanism will keep trying |
paul@0 | 41 | # to save into a queue of the specified page. |
paul@0 | 42 | |
paul@3 | 43 | if is_queued_changes_page(request, pagename): |
paul@3 | 44 | |
paul@4 | 45 | # Test the integrity of the page in order to prevent direct replacement |
paul@4 | 46 | # of the page. Reviewers can change the page as they please. |
paul@3 | 47 | |
paul@30 | 48 | if is_reviewer(request) or isinstance(request.user.may, SpecialPermissions): |
paul@4 | 49 | return None |
paul@4 | 50 | else: |
paul@4 | 51 | return Abort(_("Queued changes may not be edited.")) |
paul@0 | 52 | |
paul@0 | 53 | # For normal pages, the user has to be approved. Otherwise, the page will be |
paul@15 | 54 | # saved into a queue. If the save operation occurs as part of an approval |
paul@15 | 55 | # action, however, the effective user will be able to save the page. |
paul@0 | 56 | |
paul@15 | 57 | elif not request.action == "ApproveChanges" and not is_approved(request): |
paul@0 | 58 | |
paul@3 | 59 | # Save the page in the queue. |
paul@0 | 60 | |
paul@30 | 61 | queued_pagename = "%s/%s%s" % (pagename, user_specific_queue, queued_changes_page) |
paul@30 | 62 | new_page = PageEditor(request, queued_pagename) |
paul@0 | 63 | |
paul@4 | 64 | # Add an ACL to prevent normal users from seeing the page anywhere. |
paul@10 | 65 | # Add a parent revision to the page. |
paul@4 | 66 | |
paul@10 | 67 | directives = [ |
paul@10 | 68 | get_access_control_directive(request), |
paul@14 | 69 | get_parent_revision_directive(request, pagename), |
paul@28 | 70 | get_user_directive(request), |
paul@28 | 71 | get_user_queue_directive(request) |
paul@10 | 72 | ] |
paul@10 | 73 | |
paul@10 | 74 | body = add_directives(body, directives) |
paul@4 | 75 | |
paul@4 | 76 | username = request.user.name |
paul@4 | 77 | comment = (username or _("anonymous")) + " : " + _("Queued page edit") |
paul@4 | 78 | |
paul@0 | 79 | try: |
paul@30 | 80 | # To add a page with an ACL, a special policy is required. |
paul@4 | 81 | |
paul@30 | 82 | may = request.user.may |
paul@30 | 83 | request.user.may = SpecialPermissions(request.user, queued_pagename) |
paul@30 | 84 | |
paul@30 | 85 | # Save the page with the ACL. |
paul@30 | 86 | |
paul@6 | 87 | try: |
paul@6 | 88 | new_page.saveText(body, 0, comment=comment) |
paul@30 | 89 | |
paul@30 | 90 | # Restore the original policy. |
paul@30 | 91 | |
paul@6 | 92 | finally: |
paul@30 | 93 | request.user.may = may |
paul@4 | 94 | |
paul@0 | 95 | except PageEditor.Unchanged: |
paul@0 | 96 | pass |
paul@0 | 97 | |
paul@0 | 98 | # Abort the page save operation. |
paul@0 | 99 | |
paul@0 | 100 | return Abort(_("Your changes have been queued for approval.")) |
paul@0 | 101 | |
paul@4 | 102 | return None |
paul@4 | 103 | |
paul@0 | 104 | def handle(event): |
paul@0 | 105 | if isinstance(event, PagePreSaveEvent): |
paul@0 | 106 | return handle_presave(event) |
paul@0 | 107 | |
paul@0 | 108 | # vim: tabstop=4 expandtab shiftwidth=4 |