[Mpuls-commits] r5635 - base/trunk/mpulsweb/controllers

[scm-commit@wald.intevation.org]

Author: bh
Date: 2011-11-21 16:40:56 +0100 (Mon, 21 Nov 2011)
New Revision: 5635

Modified:
   base/trunk/mpulsweb/controllers/repeatgroup.py
Log:
Check access permissions in RepeatgroupController.delete
by using the _load_current_case method to load a case object instead of
merely loading the instance tree.

Implements the access checks for deleting repeat groups for
mpuls/issue2367.


Modified: base/trunk/mpulsweb/controllers/repeatgroup.py
===================================================================
--- base/trunk/mpulsweb/controllers/repeatgroup.py	2011-11-21 15:25:09 UTC (rev 5634)
+++ base/trunk/mpulsweb/controllers/repeatgroup.py	2011-11-21 15:40:56 UTC (rev 5635)
@@ -34,10 +34,8 @@
         """Delete rg"""
         log.debug("deleting repeat group %s" % id)
         if confirmed == '1':
-            factory = InstanceFactory(g.formedTree, PostgresDBInterface())
-            instance_tree = factory.loadInstanceTreeByIdentifier(
-                session['case'].id,
-                session.get('uncommited_fields'))
+            case = self._load_current_case()
+            instance_tree = case.get_formed_instance_tree()
             rg = instance_tree.getItem(id)
             if not rg:
                 abort(404, _('Repeat group not found.'))
@@ -52,7 +50,7 @@
                                                 u" gelöscht.")
 
             # Build new Navigation
-            navigation = get_navigation(session['case'].id,
+            navigation = get_navigation(case.id,
                                         session['navigation.openfolders'])
             session['navigation.tree'] = navigation
             session.save()