Ticket #1075: ticket-validate.diff

File ticket-validate.diff, 2.2 kB (added by athomas, 1 year ago)

Validate permissions and ticket data before updating/creating.

  • tracrpc/ticket.py

    old new  
    55from tracrpc.util import to_timestamp, to_datetime 
    66import trac.ticket.model as model 
    77import trac.ticket.query as query 
     8from trac.ticket.web_ui import TicketModule 
    89from trac.ticket.api import TicketSystem 
    910from trac.ticket.notification import TicketNotifyEmail 
    1011 
     
    2829        yield ('TICKET_VIEW', ((list, int),), self.getAvailableActions) 
    2930        yield ('TICKET_VIEW', ((list, int),), self.get) 
    3031        yield ('TICKET_CREATE', ((int, str, str), (int, str, str, dict), (int, str, str, dict, bool)), self.create) 
    31         yield ('TICKET_ADMIN', ((list, int, str), (list, int, str, dict), (list, int, str, dict, bool)), self.update) 
     32        yield ('TICKET_VIEW', ((list, int, str), (list, int, str, dict), (list, int, str, dict, bool)), self.update) 
    3233        yield ('TICKET_ADMIN', ((None, int),), self.delete) 
    3334        yield ('TICKET_VIEW', ((dict, int), (dict, int, int)), self.changeLog) 
    3435        yield ('TICKET_VIEW', ((list, int),), self.listAttachments) 
     
    8283        t['reporter'] = req.authname or 'anonymous' 
    8384        for k, v in attributes.iteritems(): 
    8485            t[k] = v 
     86        self._validate_ticket(req, t) 
    8587        t.insert() 
    8688 
    8789        if notify: 
     
    101103        t = model.Ticket(self.env, id) 
    102104        for k, v in attributes.iteritems(): 
    103105            t[k] = v 
     106        self._validate_ticket(req, t) 
    104107        t.save_changes(req.authname or 'anonymous', comment) 
    105108 
    106109        if notify: 
     
    166169        """ Return a list of all ticket fields fields. """ 
    167170        return TicketSystem(self.env).get_ticket_fields() 
    168171 
     172    def _validate_ticket(self, req, ticket): 
     173        ticket_module = TicketModule(self.env) 
     174        req.args['ts'] = str(ticket.time_changed) 
     175        if not ticket_module._validate_ticket(req, ticket): 
     176            raise TracError(' '.join(req.warnings) or 'Invalid ticket data or permissions') 
     177 
    169178 
    170179def ticketModelFactory(cls, cls_attributes): 
    171180    """ Return a class which exports an interface to trac.ticket.model.<cls>. """