Add ACL to api/config 'relations' section (#1053) (#1054)

* Add ACL to api/config 'relations' section

* Add acl check for layers for qploty

(cherry picked from commit 3a77d8b)

Co-authored-by: Walter Lorenzetti <[email protected]>

g3w-admin/client/tests/test_api.py

@@ -823,6 +823,10 @@ def testClientConfigApiViewForFilterByUser(self):
         self.assertTrue('"name": "Countries"' in layerstree)
         self.assertTrue('"name": "Rivers"' in layerstree)
 
+        # Check relations
+        self.assertEqual(len(jres['relations']), 1)
+
+
         layer_cities = self.project_print310.instance.layer_set.filter(name="Cities")
         layer_countries = self.project_print310.instance.layer_set.filter(name="Countries")
 
@@ -852,6 +856,9 @@ def testClientConfigApiViewForFilterByUser(self):
         self.assertTrue('"name": "Countries"' in layerstree)
         self.assertTrue('"name": "Rivers"' in layerstree)
 
+        # Check relations
+        self.assertEqual(len(jres['relations']), 0)
+
         self.client.logout()
 
         # Check vs other project with same layer ids
@@ -876,6 +883,9 @@ def testClientConfigApiViewForFilterByUser(self):
         self.assertTrue('"name": "Countries"' in layerstree)
         self.assertTrue('"name": "Rivers"' in layerstree)
 
+        # Check relations
+        self.assertEqual(len(jres['relations']), 1)
+
         self.client.logout()
 
         # login as viewer1.3 inside group gu_viewer2
@@ -897,6 +907,9 @@ def testClientConfigApiViewForFilterByUser(self):
         self.assertFalse('"name": "Countries"' in layerstree)
         self.assertTrue('"name": "Rivers"' in layerstree)
 
+        # Check relations
+        self.assertEqual(len(jres['relations']), 0)
+
         self.client.logout()
 
         # Check vs other project with same layer ids for user groups
@@ -918,4 +931,7 @@ def testClientConfigApiViewForFilterByUser(self):
         self.assertTrue('"name": "Countries"' in layerstree)
         self.assertTrue('"name": "Rivers"' in layerstree)
 
+        # Check relations
+        self.assertEqual(len(jres['relations']), 1)
+
 

g3w-admin/qdjango/api/projects/serializers.py

@@ -115,7 +115,16 @@ def get_map_layers_relations(self, instance):
         map_relations = []
         for relation in relations:
             relation['type'] = RELATIONS_ONE_TO_MANY
-            map_relations.append(relation)
+
+            # Check ACL for referencedLayer and referencingLayer
+            # Send only with http requests
+            if self.request:
+                referencedlayer = instance.layer_set.get(qgs_layer_id=relation['referencedLayer'])
+                referencinglayer = instance.layer_set.get(qgs_layer_id=relation['referencingLayer'])
+                if self.request.user.has_perm('qdjango.view_layer', referencedlayer) and \
+                        self.request.user.has_perm('qdjango.view_layer', referencinglayer):
+                    map_relations.append(relation)
+
         return map_relations
 
     def get_map_layers_relations_from_vectorjoins(self, layer_id, vectorjoins, layers):

g3w-admin/qplotly/receivers.py

@@ -135,6 +135,11 @@ def set_initconfig_value(sender, **kwargs):
     layers = project.layer_set.all()
 
     for layer in layers:
+
+        # Add check ACL for user
+        if not hasattr(sender, 'request') or not sender.request.user.has_perm('view_layer', layer):
+            continue
+
         qplotly_widgets = layer.qplotlywidget_set.all()
 
         for qplotly_widget in qplotly_widgets:

g3w-admin/qplotly/tests/test_api.py

@@ -23,7 +23,7 @@
     GeoConstraint, \
     GeoConstraintRule
 from rest_framework.test import APIClient
-from guardian.shortcuts import assign_perm
+from guardian.shortcuts import assign_perm, remove_perm
 from qplotly.utils import get_qplotlywidget_for_project
 from qplotly.models import QplotlyWidget
 from qplotly.utils.models import get_qplotlywidgets4layer
@@ -173,6 +173,33 @@ def test_initconfig_plugin_start(self):
         self.assertTrue('layout' in plugin_plot['plot'])
         self.assertEqual(plugin_plot['plot']['layout']['title'], {'text': ''})
 
+        # Test for users wit not permisions
+        # ---------------------------------
+        assign_perm('view_project', self.test_viewer1, self.project.instance)
+
+        response = self._testApiCall('group-map-config',
+                                     args=[self.project_group.slug, 'qdjango', self.project.instance.pk],
+                                     username=self.test_viewer1.username)
+
+        jcontent = json.loads(response.content)
+
+        self.assertEqual(plugin['plots'][0]['qgs_layer_id'], 'countries_d53dfb9a_98e1_4196_a601_eed9a33f47c3')
+
+
+        # Remove permisssion to layer for viewer1 user
+        layer = self.project.instance.layer_set.get(qgs_layer_id='countries_d53dfb9a_98e1_4196_a601_eed9a33f47c3')
+
+        remove_perm('view_layer', self.test_viewer1, layer)
+
+        response = self._testApiCall('group-map-config',
+                                     args=[self.project_group.slug, 'qdjango', self.project.instance.pk],
+                                     username=self.test_viewer1.username)
+
+        jcontent = json.loads(response.content)
+
+        self.assertFalse('qplotly' in jcontent['plugins'])
+
+
     def test_trace_api(self):
         """/qplotly/api/trace API"""