github/datasette
1
0
Fork 0
mirror of https://github.com/simonw/datasette.git synced 2025-12-10 16:51:24 +01:00
Code Issues Projects Releases Packages Wiki Activity

Removed view-row permission, for the moment - refs #811

Browse source 
https://github.com/simonw/datasette/issues/811#issuecomment-640338347
This commit is contained in:
Simon Willison 2020-06-07 20:14:27 -07:00
commit 613fa551a1
3 changed files with 0 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

3
datasette/views/table.py
View file

@ -851,9 +851,6 @@ class RowView(RowTableShared):
await self.check_permission(request, "view-instance") await self.check_permission(request, "view-instance")
await self.check_permission(request, "view-database", "database", database) await self.check_permission(request, "view-database", "database", database)
await self.check_permission(request, "view-table", "table", (database, table)) await self.check_permission(request, "view-table", "table", (database, table))
await self.check_permission(
request, "view-row", "row", tuple([database, table] + list(pk_values))
)
db = self.ds.databases[database] db = self.ds.databases[database]
pks = await db.primary_keys(table) pks = await db.primary_keys(table)
use_rowid = not pks use_rowid = not pks

13
docs/authentication.rst
View file

@ -206,19 +206,6 @@ Actor is allowed to view a table (or view) page, e.g. https://latest.datasette.i
``resource_identifier`` - tuple: (string, string) ``resource_identifier`` - tuple: (string, string)
The name of the database, then the name of the table The name of the database, then the name of the table
.. _permissions_view_row:
view-row
--------
Actor is allowed to view a row page, e.g. https://latest.datasette.io/fixtures/compound_primary_key/a,b
``resource_type`` - string
"row"
``resource_identifier`` - tuple: (string, string, strings...)
The name of the database, then the name of the table, then the primary key of the row. The primary key may be a single value or multiple values, so the ``resource_identifier`` tuple may be three or more items long.
.. _permissions_view_query: .. _permissions_view_query:
view-query view-query

1
tests/test_html.py
View file

@ -210,7 +210,6 @@ def test_row_page_does_not_truncate():
[ [
"view-instance", "view-instance",
("view-table", "table", ("fixtures", "facetable")), ("view-table", "table", ("fixtures", "facetable")),
("view-row", "row", ("fixtures", "facetable", "1")),
], ],
) )
table = Soup(response.body, "html.parser").find("table") table = Soup(response.body, "html.parser").find("table")