From 0a8e792efc33db434e93656935c5443cdee0230e Mon Sep 17 00:00:00 2001
From: Marcin Kuzminski <marcin@rhodecode.com>
Date: Wed, 27 Mar 2019 12:29:31 +0100
Subject: [PATCH] auth: reduced usage of raw auth calls inside templates

---
 rhodecode/apps/_base/__init__.py              | 22 ++++++++++++++++
 rhodecode/apps/admin/views/main_views.py      | 13 ++++++----
 rhodecode/lib/auth.py                         | 12 +++------
 rhodecode/lib/base.py                         |  1 -
 rhodecode/templates/admin/gists/index.mako    |  2 +-
 rhodecode/templates/admin/gists/show.mako     |  4 +--
 rhodecode/templates/admin/main.mako           | 10 +------
 .../repo_group_edit_permissions.mako          |  2 +-
 .../admin/repo_groups/repo_groups.mako        |  2 +-
 .../admin/repos/repo_edit_permissions.mako    |  2 +-
 rhodecode/templates/admin/repos/repos.mako    |  2 +-
 .../user_groups/user_group_edit_perms.mako    |  2 +-
 .../admin/user_groups/user_groups.mako        |  2 +-
 rhodecode/templates/base/base.mako            | 26 +++++++++----------
 .../changeset/changeset_file_comment.mako     |  2 +-
 rhodecode/templates/index_base.mako           | 11 ++------
 rhodecode/templates/summary/components.mako   |  4 +--
 rhodecode/templates/user_group/profile.mako   |  2 +-
 rhodecode/templates/users/user_profile.mako   |  2 +-
 19 files changed, 64 insertions(+), 59 deletions(-)

diff --git a/rhodecode/apps/_base/__init__.py b/rhodecode/apps/_base/__init__.py
index 9b2435d7..199a25f7 100644
--- a/rhodecode/apps/_base/__init__.py
+++ b/rhodecode/apps/_base/__init__.py
@@ -168,6 +168,28 @@ class BaseAppView(object):
             from rhodecode.lib.base import attach_context_attributes
             attach_context_attributes(c, self.request, self.request.user.user_id)
 
+        c.is_super_admin = c.auth_user.is_admin
+
+        c.can_create_repo = c.is_super_admin
+        c.can_create_repo_group = c.is_super_admin
+        c.can_create_user_group = c.is_super_admin
+
+        c.is_delegated_admin = False
+
+        if not c.auth_user.is_default:
+            c.can_create_repo = h.HasPermissionAny('hg.create.repository')(
+                user=self.request.user)
+            repositories = c.auth_user.repositories_admin or c.can_create_repo
+
+            c.can_create_repo_group = h.HasPermissionAny('hg.repogroup.create.true')(
+                user=self.request.user)
+            repository_groups = c.auth_user.repository_groups_admin or c.can_create_repo_group
+
+            c.can_create_user_group = h.HasPermissionAny('hg.usergroup.create.true')(
+                user=self.request.user)
+            user_groups = c.auth_user.user_groups_admin or c.can_create_user_group
+            # delegated admin can create, or manage some objects
+            c.is_delegated_admin = repositories or repository_groups or user_groups
         return c
 
     def _get_template_context(self, tmpl_args, **kwargs):
diff --git a/rhodecode/apps/admin/views/main_views.py b/rhodecode/apps/admin/views/main_views.py
index 6566fb2f..752b305c 100644
--- a/rhodecode/apps/admin/views/main_views.py
+++ b/rhodecode/apps/admin/views/main_views.py
@@ -20,12 +20,12 @@
 
 import logging
 
-from pyramid.httpexceptions import HTTPFound
+from pyramid.httpexceptions import HTTPFound, HTTPNotFound
 from pyramid.view import view_config
 
 from rhodecode.apps._base import BaseAppView
 from rhodecode.lib import helpers as h
-from rhodecode.lib.auth import (LoginRequired, HasPermissionAllDecorator)
+from rhodecode.lib.auth import (LoginRequired, NotAnonymous)
 from rhodecode.model.db import PullRequest
 
 
@@ -38,13 +38,17 @@ class AdminMainView(BaseAppView):
         return c
 
     @LoginRequired()
-    @HasPermissionAllDecorator('hg.admin')
+    @NotAnonymous()
     @view_config(
         route_name='admin_home', request_method='GET',
         renderer='rhodecode:templates/admin/main.mako')
     def admin_main(self):
         c = self.load_default_context()
         c.active = 'admin'
+
+        if not (c.is_super_admin or c.is_delegated_admin):
+            raise HTTPNotFound()
+
         return self._get_template_context(c)
 
     @LoginRequired()
@@ -54,8 +58,7 @@ class AdminMainView(BaseAppView):
     def pull_requests(self):
         """
         Global redirect for Pull Requests
-
-        :param pull_request_id: id of pull requests in the system
+        pull_request_id: id of pull requests in the system
         """
 
         pull_request = PullRequest.get_or_404(
diff --git a/rhodecode/lib/auth.py b/rhodecode/lib/auth.py
index c15e7890..4e6e4844 100644
--- a/rhodecode/lib/auth.py
+++ b/rhodecode/lib/auth.py
@@ -2078,8 +2078,7 @@ class HasRepoPermissionAny(PermsFunction):
 class HasRepoGroupPermissionAny(PermsFunction):
     def __call__(self, group_name=None, check_location='', user=None):
         self.repo_group_name = group_name
-        return super(HasRepoGroupPermissionAny, self).__call__(
-            check_location, user)
+        return super(HasRepoGroupPermissionAny, self).__call__(check_location, user)
 
     def check_permissions(self, user):
         perms = user.permissions
@@ -2095,8 +2094,7 @@ class HasRepoGroupPermissionAny(PermsFunction):
 class HasRepoGroupPermissionAll(PermsFunction):
     def __call__(self, group_name=None, check_location='', user=None):
         self.repo_group_name = group_name
-        return super(HasRepoGroupPermissionAll, self).__call__(
-            check_location, user)
+        return super(HasRepoGroupPermissionAll, self).__call__(check_location, user)
 
     def check_permissions(self, user):
         perms = user.permissions
@@ -2112,8 +2110,7 @@ class HasRepoGroupPermissionAll(PermsFunction):
 class HasUserGroupPermissionAny(PermsFunction):
     def __call__(self, user_group_name=None, check_location='', user=None):
         self.user_group_name = user_group_name
-        return super(HasUserGroupPermissionAny, self).__call__(
-            check_location, user)
+        return super(HasUserGroupPermissionAny, self).__call__(check_location, user)
 
     def check_permissions(self, user):
         perms = user.permissions
@@ -2129,8 +2126,7 @@ class HasUserGroupPermissionAny(PermsFunction):
 class HasUserGroupPermissionAll(PermsFunction):
     def __call__(self, user_group_name=None, check_location='', user=None):
         self.user_group_name = user_group_name
-        return super(HasUserGroupPermissionAll, self).__call__(
-            check_location, user)
+        return super(HasUserGroupPermissionAll, self).__call__(check_location, user)
 
     def check_permissions(self, user):
         perms = user.permissions
diff --git a/rhodecode/lib/base.py b/rhodecode/lib/base.py
index 2f3c4e8c..827a1bac 100644
--- a/rhodecode/lib/base.py
+++ b/rhodecode/lib/base.py
@@ -288,7 +288,6 @@ def attach_context_attributes(context, request, user_id=None):
     """
     config = request.registry.settings
 
-
     rc_config = SettingsModel().get_all_settings(cache=True)
 
     context.rhodecode_version = rhodecode.__version__
diff --git a/rhodecode/templates/admin/gists/index.mako b/rhodecode/templates/admin/gists/index.mako
index e417225e..480e45c6 100644
--- a/rhodecode/templates/admin/gists/index.mako
+++ b/rhodecode/templates/admin/gists/index.mako
@@ -52,7 +52,7 @@
     ##main
     <div class="sidebar">
         <ul class="nav nav-pills nav-stacked">
-          % if h.HasPermissionAll('hg.admin')('access admin gists page'):
+          % if c.is_super_admin:
             <li class="${'active' if c.active=='all' else ''}"><a href="${h.route_path('gists_show', _query={'all': 1})}">${_('All gists')}</a></li>
           %endif
           <li class="${'active' if c.active=='public' else ''}"><a href="${h.route_path('gists_show')}">${_('All public')}</a></li>
diff --git a/rhodecode/templates/admin/gists/show.mako b/rhodecode/templates/admin/gists/show.mako
index efde2683..2c841140 100644
--- a/rhodecode/templates/admin/gists/show.mako
+++ b/rhodecode/templates/admin/gists/show.mako
@@ -48,7 +48,7 @@
                         </code>
                     </div>
                     <div class="stats">
-                       %if h.HasPermissionAny('hg.admin')() or c.gist.gist_owner == c.rhodecode_user.user_id:
+                       %if c.is_super_admin or c.gist.gist_owner == c.rhodecode_user.user_id:
                         <div class="remove_gist">
                             ${h.secure_form(h.route_path('gist_delete', gist_id=c.gist.gist_access_id), request=request)}
                                 ${h.submit('remove_gist', _('Delete'),class_="btn btn-mini btn-danger",onclick="return confirm('"+_('Confirm to delete this Gist')+"');")}
@@ -59,7 +59,7 @@
                           ## only owner should see that
                           <a href="#copySource" onclick="return false;" class="btn btn-mini icon-clipboard clipboard-action" data-clipboard-text="${c.files[0].content}">${_('Copy content')}</a>
 
-                          %if h.HasPermissionAny('hg.admin')() or c.gist.gist_owner == c.rhodecode_user.user_id:
+                          %if c.is_super_admin or c.gist.gist_owner == c.rhodecode_user.user_id:
                             ${h.link_to(_('Edit'), h.route_path('gist_edit', gist_id=c.gist.gist_access_id), class_="btn btn-mini")}
                           %endif
                           ${h.link_to(_('Show as Raw'), h.route_path('gist_show_formatted', gist_id=c.gist.gist_access_id, revision='tip', format='raw'), class_="btn btn-mini")}
diff --git a/rhodecode/templates/admin/main.mako b/rhodecode/templates/admin/main.mako
index 108bce38..9a57210e 100644
--- a/rhodecode/templates/admin/main.mako
+++ b/rhodecode/templates/admin/main.mako
@@ -34,16 +34,8 @@
 <div class="box">
 
     ##main
-    <div class='sidebar-col-wrapper'>
-      <div class="sidebar">
-          <ul class="nav nav-pills nav-stacked">
-            ${self.side_bar_nav()}
-          </ul>
-      </div>
-
-      <div class="main-content-auto-width">
+    <div class="main-content-auto-width">
         ${self.main_content()}
-      </div>
     </div>
 </div>
 
diff --git a/rhodecode/templates/admin/repo_groups/repo_group_edit_permissions.mako b/rhodecode/templates/admin/repo_groups/repo_group_edit_permissions.mako
index 5f8eb175..0a6f183c 100644
--- a/rhodecode/templates/admin/repo_groups/repo_group_edit_permissions.mako
+++ b/rhodecode/templates/admin/repo_groups/repo_group_edit_permissions.mako
@@ -141,7 +141,7 @@
                     <td class="td-radio">${h.radio('g_perm_%s' % _user_group.users_group_id,'group.admin', checked=_user_group.permission=='group.admin')}</td>
                     <td class="td-componentname">
                         <i class="icon-user-group"></i>
-                        %if h.HasPermissionAny('hg.admin')():
+                        %if c.is_super_admin:
                          <a href="${h.route_path('edit_user_group',user_group_id=_user_group.users_group_id)}">
                              ${_user_group.users_group_name}
                          </a>
diff --git a/rhodecode/templates/admin/repo_groups/repo_groups.mako b/rhodecode/templates/admin/repo_groups/repo_groups.mako
index 176fc39b..cdcb6bb1 100644
--- a/rhodecode/templates/admin/repo_groups/repo_groups.mako
+++ b/rhodecode/templates/admin/repo_groups/repo_groups.mako
@@ -26,7 +26,7 @@
     <div class="title">
 
         <ul class="links">
-            %if h.HasPermissionAny('hg.admin','hg.repogroup.create.true')():
+            %if c.can_create_repo_group:
              <li>
                <a href="${h.route_path('repo_group_new')}" class="btn btn-small btn-success">${_(u'Add Repository Group')}</a>
              </li>
diff --git a/rhodecode/templates/admin/repos/repo_edit_permissions.mako b/rhodecode/templates/admin/repos/repo_edit_permissions.mako
index 84367af9..06ce9901 100644
--- a/rhodecode/templates/admin/repos/repo_edit_permissions.mako
+++ b/rhodecode/templates/admin/repos/repo_edit_permissions.mako
@@ -136,7 +136,7 @@
                     <td class="td-radio">${h.radio('g_perm_%s' % _user_group.users_group_id,'repository.admin', checked=_user_group.permission=='repository.admin')}</td>
                     <td class="td-componentname">
                         <i class="icon-user-group"></i>
-                        %if h.HasPermissionAny('hg.admin')():
+                        %if c.is_super_admin:
                          <a href="${h.route_path('edit_user_group',user_group_id=_user_group.users_group_id)}">
                              ${_user_group.users_group_name}
                          </a>
diff --git a/rhodecode/templates/admin/repos/repos.mako b/rhodecode/templates/admin/repos/repos.mako
index 434d30fd..38c05517 100644
--- a/rhodecode/templates/admin/repos/repos.mako
+++ b/rhodecode/templates/admin/repos/repos.mako
@@ -25,7 +25,7 @@
 <div class="box">
     <div class="title">
         <ul class="links">
-            %if h.HasPermissionAny('hg.admin','hg.create.repository')():
+            %if c.can_create_repo:
              <li>
                <a href="${h.route_path('repo_new')}" class="btn btn-small btn-success">${_(u'Add Repository')}</a>
              </li>
diff --git a/rhodecode/templates/admin/user_groups/user_group_edit_perms.mako b/rhodecode/templates/admin/user_groups/user_group_edit_perms.mako
index 700c96ec..5d066fb7 100644
--- a/rhodecode/templates/admin/user_groups/user_group_edit_perms.mako
+++ b/rhodecode/templates/admin/user_groups/user_group_edit_perms.mako
@@ -143,7 +143,7 @@
                     <td class="td-radio">${h.radio('g_perm_%s' % _user_group.users_group_id,'usergroup.admin')}</td>
                     <td class="td-user">
                         <i class="icon-user-group"></i>
-                        %if h.HasPermissionAny('hg.admin')():
+                        %if c.is_super_admin:
                          <a href="${h.route_path('edit_user_group',user_group_id=_user_group.users_group_id)}">
                              ${_user_group.users_group_name}
                          </a>
diff --git a/rhodecode/templates/admin/user_groups/user_groups.mako b/rhodecode/templates/admin/user_groups/user_groups.mako
index 4addb59e..25bf22b5 100644
--- a/rhodecode/templates/admin/user_groups/user_groups.mako
+++ b/rhodecode/templates/admin/user_groups/user_groups.mako
@@ -26,7 +26,7 @@
 
     <div class="title">
         <ul class="links">
-        %if h.HasPermissionAny('hg.admin', 'hg.usergroup.create.true')():
+        %if c.can_create_user_group:
           <li>
             <a href="${h.route_path('user_groups_new')}" class="btn btn-small btn-success">${_(u'Add User Group')}</a>
           </li>
diff --git a/rhodecode/templates/base/base.mako b/rhodecode/templates/base/base.mako
index 6704aa68..6e474955 100644
--- a/rhodecode/templates/base/base.mako
+++ b/rhodecode/templates/base/base.mako
@@ -76,12 +76,6 @@
 
 <%def name="admin_menu(active=None)">
   <%
-    is_super_admin = c.rhodecode_user.is_admin
-    repositories=c.rhodecode_user.repositories_admin
-    repository_groups=c.rhodecode_user.repository_groups_admin
-    user_groups=c.rhodecode_user.user_groups_admin or h.HasPermissionAny('hg.usergroup.create.true')()
-    is_delegated_admin = repositories or repository_groups or user_groups
-
     def is_active(selected):
         if selected == active:
             return "active"
@@ -104,7 +98,7 @@
     <ul id="context-pages" class="navigation horizontal-list">
 
         ## super admin case
-        % if is_super_admin:
+        % if c.is_super_admin:
           <li class="${is_active('audit_logs')}"><a href="${h.route_path('admin_audit_logs')}">${_('Admin audit logs')}</a></li>
           <li class="${is_active('repositories')}"><a href="${h.route_path('repos')}">${_('Repositories')}</a></li>
           <li class="${is_active('repository_groups')}"><a href="${h.route_path('repo_groups')}">${_('Repository groups')}</a></li>
@@ -117,7 +111,13 @@
           <li class="${is_active('settings')}"><a href="${h.route_path('admin_settings')}">${_('Settings')}</a></li>
 
         ## delegated admin
-        % elif is_delegated_admin:
+        % elif c.is_delegated_admin:
+           <%
+           repositories=c.auth_user.repositories_admin or c.can_create_repo
+           repository_groups=c.auth_user.repository_groups_admin or c.can_create_repo_group
+           user_groups=c.auth_user.user_groups_admin or c.can_create_user_group
+           %>
+
            %if repositories:
               <li class="${is_active('repositories')} local-admin-repos"><a href="${h.route_path('repos')}">${_('Repositories')}</a></li>
            %endif
@@ -361,8 +361,6 @@
         if selected == active:
             return "active"
 
-    is_admin = h.HasPermissionAny('hg.admin')('can create repos index page')
-
     gr_name = c.repo_group.group_name if c.repo_group else None
     # create repositories with write permission on group is set to true
     create_on_write = h.HasPermissionAny('hg.create.write_on_repogroup.true')()
@@ -380,7 +378,7 @@
 
       <ul id="context-pages" class="navigation horizontal-list">
         <li class="${is_active('home')}"><a class="menulink" href="${h.route_path('repo_group_home', repo_group_name=c.repo_group.group_name)}"><div class="menulabel">${_('Group Home')}</div></a></li>
-        % if is_admin or group_admin:
+        % if c.is_super_admin or group_admin:
             <li class="${is_active('settings')}"><a class="menulink" href="${h.route_path('edit_repo_group',repo_group_name=c.repo_group.group_name)}" title="${_('You have admin right to this group, and can edit it')}"><div class="menulabel">${_('Group Settings')}</div></a></li>
         % endif
 
@@ -389,10 +387,10 @@
               <div class="menulabel">${_('Options')} <div class="show_more"></div></div>
           </a>
           <ul class="submenu">
-                %if is_admin or group_admin or (group_write and create_on_write):
+                %if c.is_super_admin or group_admin or (group_write and create_on_write):
                     <li><a href="${h.route_path('repo_new',_query=dict(parent_group=c.repo_group.group_id))}">${_('Add Repository')}</a></li>
                 %endif
-                %if is_admin or group_admin:
+                %if c.is_super_admin or group_admin:
                     <li><a href="${h.route_path('repo_group_new',_query=dict(parent_group=c.repo_group.group_id))}">${_(u'Add Parent Group')}</a></li>
                 %endif
              </ul>
@@ -611,11 +609,13 @@
           </a>
         </li>
 
+        % if c.is_super_admin or c.is_delegated_admin:
         <li class="${is_active('admin')}">
           <a class="menulink childs" title="${_('Admin settings')}" href="${h.route_path('admin_home')}">
             <div class="menulabel">${_('Admin')} </div>
           </a>
         </li>
+        % endif
 
       ## render extra user menu
       ${usermenu(active=(active=='my_account'))}
diff --git a/rhodecode/templates/changeset/changeset_file_comment.mako b/rhodecode/templates/changeset/changeset_file_comment.mako
index 037a8e6d..0b049d1a 100644
--- a/rhodecode/templates/changeset/changeset_file_comment.mako
+++ b/rhodecode/templates/changeset/changeset_file_comment.mako
@@ -139,7 +139,7 @@
             ## only super-admin, repo admin OR comment owner can delete, also hide delete if currently viewed comment is outdated
             %if not outdated_at_ver and (not comment.pull_request or (comment.pull_request and not comment.pull_request.is_closed())):
                ## permissions to delete
-               %if h.HasPermissionAny('hg.admin')() or h.HasRepoPermissionAny('repository.admin')(c.repo_name) or comment.author.user_id == c.rhodecode_user.user_id:
+               %if c.is_super_admin or h.HasRepoPermissionAny('repository.admin')(c.repo_name) or comment.author.user_id == c.rhodecode_user.user_id:
                   ## TODO: dan: add edit comment here
                   <a onclick="return Rhodecode.comments.deleteComment(this);" class="delete-comment"> ${_('Delete')}</a>
                %else:
diff --git a/rhodecode/templates/index_base.mako b/rhodecode/templates/index_base.mako
index fbe4e689..0b56beb1 100644
--- a/rhodecode/templates/index_base.mako
+++ b/rhodecode/templates/index_base.mako
@@ -14,20 +14,13 @@
         <div class="title">
             %if c.rhodecode_user.username != h.DEFAULT_USER:
               <div class="block-right">
-                <%
-                    is_admin = h.HasPermissionAny('hg.admin')('can create repos index page')
-                    create_repo = h.HasPermissionAny('hg.create.repository')('can create repository index page')
-                    create_repo_group = h.HasPermissionAny('hg.repogroup.create.true')('can create repository groups index page')
-                    create_user_group = h.HasPermissionAny('hg.usergroup.create.true')('can create user groups index page')
-                %>
-
                 %if not c.repo_group:
                     ## no repository group context here
-                    %if is_admin or create_repo:
+                    %if c.is_super_admin or c.can_create_repo:
                         <a href="${h.route_path('repo_new')}" class="btn btn-small btn-success btn-primary">${_('Add Repository')}</a>
                     %endif
 
-                    %if is_admin or create_repo_group:
+                    %if c.is_super_admin or c.can_create_repo_group:
                         <a href="${h.route_path('repo_group_new')}" class="btn btn-small btn-default">${_(u'Add Repository Group')}</a>
                     %endif
                 %endif
diff --git a/rhodecode/templates/summary/components.mako b/rhodecode/templates/summary/components.mako
index bde86b97..f79b53c6 100644
--- a/rhodecode/templates/summary/components.mako
+++ b/rhodecode/templates/summary/components.mako
@@ -173,7 +173,7 @@
                     <span class="disabled">
                         ${_('Downloads are disabled for this repository')}.
                     </span>
-                    % if h.HasPermissionAll('hg.admin')('enable downloads on from summary'):
+                    % if c.is_super_admin:
                        ${h.link_to(_('Enable downloads'),h.route_path('edit_repo',repo_name=c.repo_name, _anchor='repo_enable_downloads'))}
                     % endif
                 % else:
@@ -205,7 +205,7 @@
                   <span class="disabled">
                       ${_('Statistics are disabled for this repository')}.
                   </span>
-                  % if h.HasPermissionAll('hg.admin')('enable stats on from summary'):
+                  % if c.is_super_admin:
                      ${h.link_to(_('Enable statistics'),h.route_path('edit_repo',repo_name=c.repo_name, _anchor='repo_enable_statistics'))}
                   % endif
               % endif
diff --git a/rhodecode/templates/user_group/profile.mako b/rhodecode/templates/user_group/profile.mako
index 39d78a30..4b5d884f 100644
--- a/rhodecode/templates/user_group/profile.mako
+++ b/rhodecode/templates/user_group/profile.mako
@@ -3,7 +3,7 @@
 <div class="panel panel-default user-profile">
     <div class="panel-heading">
         <h3 class="panel-title">${_('User group profile')}</h3>
-        %if h.HasPermissionAny('hg.admin')():
+        %if c.is_super_admin:
             ${h.link_to(_('Edit'), h.route_path('edit_user_group', user_group_id=c.user_group.users_group_id), class_='panel-edit')}
         %endif
     </div>
diff --git a/rhodecode/templates/users/user_profile.mako b/rhodecode/templates/users/user_profile.mako
index 00b9eb45..9fa03239 100644
--- a/rhodecode/templates/users/user_profile.mako
+++ b/rhodecode/templates/users/user_profile.mako
@@ -3,7 +3,7 @@
 <div class="panel panel-default user-profile">
     <div class="panel-heading">
         <h3 class="panel-title">${_('User Profile')}</h3>
-        %if h.HasPermissionAny('hg.admin')():
+        %if c.is_super_admin:
             ${h.link_to(_('Edit'), h.route_path('user_edit', user_id=c.user.user_id), class_='panel-edit')}
         %endif
     </div>