github/datasette
1
0
Fork 0
mirror of https://github.com/simonw/datasette.git synced 2025-12-10 16:51:24 +01:00
Code Issues Projects Releases Packages Wiki Activity

Respect query permissions on database page, refs #800

Browse source
This commit is contained in:
Simon Willison 2020-06-06 12:05:22 -07:00
commit 3f83d4632a
5 changed files with 47 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

2
datasette/templates/database.html
View file

@ -60,7 +60,7 @@
<h2 id="queries">Queries</h2>
<ul>
{% for query in queries %}
<li><a href="{{ database_url(database) }}/{{ query.name|urlencode }}{% if query.fragment %}#{{ query.fragment }}{% endif %}" title="{{ query.description or query.sql }}">{{ query.title or query.name }}</a></li>
<li><a href="{{ database_url(database) }}/{{ query.name|urlencode }}{% if query.fragment %}#{{ query.fragment }}{% endif %}" title="{{ query.description or query.sql }}">{{ query.title or query.name }}</a> {% if query.requires_auth %} - requires authentication{% endif %}</li>
{% endfor %}
</ul>
{% endif %}

1
datasette/utils/__init__.py
View file

@ -857,6 +857,7 @@ def call_with_supported_arguments(fn, **kwargs):
def actor_matches_allow(actor, allow):
actor = actor or {}
if allow is None:
return True
for key, values in allow.items():

13
datasette/views/database.py
View file

@ -2,6 +2,7 @@ import os
import jinja2
from datasette.utils import (
actor_matches_allow,
to_css_class,
validate_sql_select,
is_url,
@ -53,6 +54,16 @@ class DatabaseView(DataView):
)
tables.sort(key=lambda t: (t["hidden"], t["name"]))
canned_queries = [
dict(
query,
requires_auth=not actor_matches_allow(None, query.get("allow", None)),
)
for query in self.ds.get_canned_queries(database)
if actor_matches_allow(
request.scope.get("actor", None), query.get("allow", None)
)
]
return (
{
"database": database,
@ -60,7 +71,7 @@ class DatabaseView(DataView):
"tables": tables,
"hidden_count": len([t for t in tables if t["hidden"]]),
"views": views,
"queries": self.ds.get_canned_queries(database),
"queries": canned_queries,
},
{
"show_hidden": request.args.get("_show_hidden"),