mirror of
https://github.com/netbox-community/netbox.git
synced 2024-05-10 07:54:54 +00:00
9628dead07
* Initial work on new search backend * Clean up search backends * Return only the most relevant result per object * Clear any pre-existing cached entries on cache() * #6003: Implement global search functionality for custom field values * Tweak field weights & document guidance * Extend search() to accept a lookup type * Move get_registry() out of SearchBackend * Enforce object permissions when returning search results * Add indexers for remaining models * Avoid calling remove() on non-cacheable objects * Use new search backend by default * Extend search backend to filter by object type * Clean up search view form * Enable specifying lookup logic * Add indexes for value field * Remove object type selector from search bar * Introduce SearchTable and enable HTMX for results * Enable pagination * Remove legacy search backend * Cleanup * Use a UUID for CachedValue primary key * Refactoring search methods * Define max search results limit * Extend reindex command to support specifying particular models * Add clear() and size to SearchBackend * Optimize bulk caching performance * Highlight matched portion of field value * Performance improvements for reindexing * Started on search tests * Cleanup & docs * Documentation updates * Clean up SearchIndex * Flatten search registry to register by app_label.model_name * Clean up search backend classes * Clean up RestrictedGenericForeignKey and RestrictedPrefetch * Resolve migrations conflict
68 lines
2.6 KiB
Python
68 lines
2.6 KiB
Python
from django.db.models import Prefetch, QuerySet
|
|
|
|
from users.constants import CONSTRAINT_TOKEN_USER
|
|
from utilities.permissions import permission_is_exempt, qs_filter_from_constraints
|
|
|
|
|
|
class RestrictedPrefetch(Prefetch):
|
|
"""
|
|
Extend Django's Prefetch to accept a user and action to be passed to the
|
|
`restrict()` method of the related object's queryset.
|
|
"""
|
|
def __init__(self, lookup, user, action='view', queryset=None, to_attr=None):
|
|
self.restrict_user = user
|
|
self.restrict_action = action
|
|
|
|
super().__init__(lookup, queryset=queryset, to_attr=to_attr)
|
|
|
|
def get_current_queryset(self, level):
|
|
params = {
|
|
'user': self.restrict_user,
|
|
'action': self.restrict_action,
|
|
}
|
|
|
|
if qs := super().get_current_queryset(level):
|
|
return qs.restrict(**params)
|
|
|
|
# Bit of a hack. If no queryset is defined, pass through the dict of restrict()
|
|
# kwargs to be handled by the field. This is necessary e.g. for GenericForeignKey
|
|
# fields, which do not permit setting a queryset on a Prefetch object.
|
|
return params
|
|
|
|
|
|
class RestrictedQuerySet(QuerySet):
|
|
|
|
def restrict(self, user, action='view'):
|
|
"""
|
|
Filter the QuerySet to return only objects on which the specified user has been granted the specified
|
|
permission.
|
|
|
|
:param user: User instance
|
|
:param action: The action which must be permitted (e.g. "view" for "dcim.view_site"); default is 'view'
|
|
"""
|
|
# Resolve the full name of the required permission
|
|
app_label = self.model._meta.app_label
|
|
model_name = self.model._meta.model_name
|
|
permission_required = f'{app_label}.{action}_{model_name}'
|
|
|
|
# Bypass restriction for superusers and exempt views
|
|
if user.is_superuser or permission_is_exempt(permission_required):
|
|
qs = self
|
|
|
|
# User is anonymous or has not been granted the requisite permission
|
|
elif not user.is_authenticated or permission_required not in user.get_all_permissions():
|
|
qs = self.none()
|
|
|
|
# Filter the queryset to include only objects with allowed attributes
|
|
else:
|
|
tokens = {
|
|
CONSTRAINT_TOKEN_USER: user,
|
|
}
|
|
attrs = qs_filter_from_constraints(user._object_perm_cache[permission_required], tokens)
|
|
# #8715: Avoid duplicates when JOIN on many-to-many fields without using DISTINCT.
|
|
# DISTINCT acts globally on the entire request, which may not be desirable.
|
|
allowed_objects = self.model.objects.filter(attrs)
|
|
qs = self.filter(pk__in=allowed_objects)
|
|
|
|
return qs
|