Adds group requirements

main/decorators.py

@@ -0,0 +1,16 @@
+from django.conf import settings
+from django.contrib.auth.decorators import user_passes_test
+
+def groups_required(*group_names):
+    """Requires user membership in at least one of the groups passed in."""
+    def in_groups(u):
+        if u.is_authenticated():
+            if bool(u.groups.filter(name__in=group_names)) | u.is_superuser:
+                return True
+        # Gi brukeren beskjed (muligens)
+        message = "Jeg kan ikke gi deg tilgang fordi \
+            du er ikke i noen av disse gruppene: {0}.".format(
+                ", ".join(settings.GROUPS_ALLOWED))
+        u.message_set.create(message=message)
+        return False
+    return user_passes_test(in_groups)

main/templates/registration/login.html

@@ -2,6 +2,16 @@
 
 {% block content %}
 
+{% if messages %}
+<div class="row">
+    <div class="span6">
+    {% for message in messages %}
+    <div class="alert-message warning">{{ message }}</div>
+    {% endfor %}
+    </div>
+</div>
+{% endif %}
+
 {% include "registration/login_form.html" %}
 
 {% endblock %}

main/urls.py

@@ -1,22 +1,25 @@
 from datetime import datetime
 
 from django.conf.urls.defaults import patterns, include, url
-from django.views.generic.list_detail import object_list # FIXME: subclass?
+from django.views.generic.list_detail import object_list
 from django.contrib.auth.decorators import login_required
+from django.conf import settings
 
 from models import *
 
+from decorators import groups_required
+
 urlpatterns = patterns('main.views',
     url(r'^system/$', 'system', name='system'),
     url(r'^new/$', 'new', name='new'),
     url(r'^new/created/$', 'new_created', name='new_created'),
     url(r'^list/page(?P<page>[0-9]+)/$',
-        login_required(object_list), {
+        groups_required(settings.GROUPS_ALLOWED)(login_required(object_list)), {
             'queryset': TempUserLog.objects.filter(expires__gt=datetime.now()).order_by('created').reverse(),
             'template_name':'private/list.html'
         }, name='list_page'),
     url(r'^list/',
-        login_required(object_list), {
+        groups_required(settings.GROUPS_ALLOWED)(login_required(object_list)), {
             'queryset': TempUserLog.objects.filter(expires__gt=datetime.now()).order_by('created').reverse(),
             'template_name':'private/list.html'
         },

main/views.py

@@ -20,6 +20,7 @@ from models import *
 from radius.models import *
 from forms import *
 import utils
+from decorators import groups_required
 
 from pdf import render_to_pdf
 
@@ -37,6 +38,7 @@ def index(request):
 
     return render_to_response('public/index.html', locals(), context_instance=RequestContext(request))
 
+@groups_required(settings.GROUPS_ALLOWED)
 @login_required
 def new(request):
     if request.method == "POST":
@@ -74,6 +76,7 @@ def new(request):
 
     return render_to_response('private/new.html', locals(), context_instance=RequestContext(request))
 
+@groups_required(settings.GROUPS_ALLOWED)
 @login_required
 def new_created(request):
     # Retrieve the last id from session
@@ -85,11 +88,13 @@ def new_created(request):
         tempuserlog_id = 0
     return render_to_response('private/new_created.html', locals(), context_instance=RequestContext(request))
 
+@groups_required(settings.GROUPS_ALLOWED)
 @login_required
 def system(request):
     return render_to_response('private/system.html', locals(), context_instance=RequestContext(request))
 
 
+@groups_required(settings.GROUPS_ALLOWED)
 @login_required
 def download_pdf(request, tempuserlog_id=-1):
     log = get_object_or_404(TempUserLog, pk=tempuserlog_id)

settings-sample.py

@@ -172,10 +172,8 @@ AUTH_LDAP_USER_FLAGS_BY_GROUP = {
     "is_staff": "cn=edb,ou=Groups,dc=neuf,dc=no",
     "is_superuser": "cn=edbadmin,ou=Groups,dc=neuf,dc=no"
 }
-AUTH_LDAP_REQUIRE_GROUP = LDAPSearch(
-    "ou=Groups,dc=neuf,dc=no",
-    ldap.SCOPE_ONELEVEL,
-    "(|(cn=dns-styret)(cn=dns-admin)(cn=dns-billettluka)(cn=edb))")
+#AUTH_LDAP_REQUIRE_GROUP = "cn=edb,ou=Groups,dc=neuf,dc=no"
+
 # Group to profile flag mappings, not used.
 AUTH_LDAP_PROFILE_FLAGS_BY_GROUP = {
     #"is_edb": "cn=edb,ou=Groups,dc=neuf,dc=no"
@@ -224,3 +222,5 @@ LOGGING = {
 }
 
 LOGIN_REDIRECT_URL = '/system/'
+# List of required groups to use MBFTNS (enforced per view)
+GROUPS_ALLOWED = ['dns-admin','edb','dns-billettluka','dns-styret']