fastfix

abonapp/templates/abonapp/group_list.html

@@ -63,12 +63,16 @@
                         <span class="glyphicon glyphicon-plus"></span> {% trans 'Add group' %}
                     </a>
                     {% endif %}
+		    {% if perms.abonapp.can_view_abonlog %}
                     <a href="{% url 'abonapp:log' %}" class="btn btn-default btn-sm">
                         <span class="glyphicon glyphicon-record"></span> {% trans 'Subscribers actions' %}
                     </a>
+		    {% endif %}
+		    {% if perms.abonapp.can_view_invoiceforpayment %}
                     <a href="{% url 'abonapp:debtors' %}" class="btn btn-default btn-sm">
                         <span class="glyphicon glyphicon-exclamation-sign"></span> {% trans 'List of debtors' %}
                     </a>
+		    {% endif %}
                 </td>
             </tr>
             </tfoot>
@@ -77,4 +81,4 @@
 
     {% include 'toolbar_page.html' with pag=groups %}
 
-{% endblock %}
+{% endblock %}

abonapp/templates/abonapp/payHistory.html

@@ -31,8 +31,7 @@
         <tfoot>
         <tr>
             <td colspan="5" class="btn-group btn-group-sm">
-                {% get_obj_perms request.user for abon as 'fill_perm' %}
-                {% if 'abonapp.can_add_ballance' in fill_perm %}
+                {% if perms.abonapp.can_add_ballance %}
                     <a href="{% url 'abonapp:abon_amount' abon_group.pk abon.pk %}" class="btn btn-default btn-modal">
                         <span class="glyphicon glyphicon-credit-card"></span> {% trans 'Fill account' %}
                     </a>
@@ -51,4 +50,4 @@
     </table>
 
     {% include 'toolbar_page.html' with pag=pay_history %}
-{% endblock %}
+{% endblock %}

abonapp/views.py

@@ -201,13 +201,12 @@ def del_abon(request):
 
 
 @login_required
+@permission_required('abonapp.can_add_ballance')
 @atomic
 def abonamount(request, gid, uid):
     abon = get_object_or_404(models.Abon, pk=uid)
     try:
         if request.method == 'POST':
-            if not request.user.has_perm('abonapp.can_add_ballance', abon):
-                raise PermissionDenied
             abonid = mydefs.safe_int(request.POST.get('abonid'))
             if abonid == int(uid):
                 amnt = mydefs.safe_float(request.POST.get('amount'))
@@ -277,11 +276,13 @@ def abon_services(request, gid, uid):
 def abonhome(request, gid, uid):
     abon = get_object_or_404(models.Abon, pk=uid)
     abon_group = get_object_or_404(models.AbonGroup, pk=gid)
+    if not request.user.has_perm('abonapp.can_view_abongroup', abon_group):
+        raise PermissionDenied
     frm = None
     passw = None
     try:
         if request.method == 'POST':
-            if not request.user.has_perm('abonapp.change_abon', abon):
+            if not request.user.has_perm('abonapp.change_abon'):
                 raise PermissionDenied
             frm = forms.AbonForm(request.POST, instance=abon)
             if frm.is_valid():
@@ -319,8 +320,6 @@ def abonhome(request, gid, uid):
             'dev_ports': DevPort.objects.filter(device=abon.device) if abon.device else None
         })
     else:
-        if not request.user.has_perm('abonapp.can_view_abongroup', abon_group):
-            raise PermissionDenied
         return render(request, 'abonapp/viewAbon.html', {
             'abon': abon,
             'abon_group': abon_group,
@@ -374,12 +373,11 @@ def add_invoice(request, gid, uid):
 
 
 @login_required
+@permission_required('abonapp.can_buy_tariff')
 @atomic
 def pick_tariff(request, gid, uid):
     grp = get_object_or_404(models.AbonGroup, pk=gid)
     abon = get_object_or_404(models.Abon, pk=uid)
-    if not request.user.has_perm('abonapp.can_buy_tariff', abon):
-        raise PermissionDenied
     tariffs = grp.tariffs.all()
     try:
         if request.method == 'POST':
@@ -414,12 +412,11 @@ def pick_tariff(request, gid, uid):
 
 
 @login_required
-@mydefs.only_admins
+@permission_required('abonapp.delete_abontariff')
+@permission_required('abonapp.can_view_abongroup', (models.AbonGroup, 'pk', 'gid'))
 def unsubscribe_service(request, gid, uid, abon_tariff_id):
     try:
         abon_tariff = get_object_or_404(models.AbonTariff, pk=int(abon_tariff_id))
-        if not request.user.has_perm('abonapp.delete_abontariff', abon_tariff):
-            raise PermissionDenied
         abon_tariff.delete()
         messages.success(request, _('User has been detached from service'))
     except NasFailedResult as e:
@@ -465,12 +462,10 @@ def task_log(request, gid, uid):
 
 
 @login_required
-@mydefs.only_admins
+@permission_required('abonapp.can_view_passport')
 def passport_view(request, gid, uid):
     try:
         abon = models.Abon.objects.get(pk=uid)
-        if not request.user.has_perm('abonapp.can_view_passport', abon):
-            raise PermissionDenied
         if request.method == 'POST':
             try:
                 passport_instance = models.PassportInfo.objects.get(abon=abon)
@@ -546,12 +541,11 @@ def dev(request, gid, uid):
 
 
 @login_required
-@mydefs.only_admins
+@permission_required('abonapp.change_abon')
+@permission_required('abonapp.can_view_abongroup', (models.AbonGroup, 'pk', 'gid'))
 def clear_dev(request, gid, uid):
     try:
         abon = models.Abon.objects.get(pk=uid)
-        if not request.user.has_perm('abonapp.change_abon', abon):
-            raise PermissionDenied
         abon.device = None
         abon.save(update_fields=['device'])
         messages.success(request, _('Device has successfully unattached'))
@@ -738,7 +732,7 @@ def dials(request, gid, uid):
 
 
 @login_required
-@mydefs.only_admins
+@permission_required('abonapp.change_abon')
 def save_user_dev_port(request, gid, uid):
     if request.method != 'POST':
         messages.error(request, _('Method is not POST'))
@@ -751,8 +745,6 @@ def save_user_dev_port(request, gid, uid):
         else:
             port = DevPort.objects.get(pk=user_port)
         abon = models.Abon.objects.get(pk=uid)
-        if not request.user.has_perm('abonapp.change_abon', abon):
-            raise PermissionDenied
         abon.dev_port = port
         if abon.is_dynamic_ip != is_dynamic_ip:
             abon.is_dynamic_ip = is_dynamic_ip
@@ -769,6 +761,7 @@ def save_user_dev_port(request, gid, uid):
 
 @login_required
 @permission_required('abonapp.add_abonstreet')
+@permission_required('abonapp.can_view_abongroup', (models.AbonGroup, 'pk', 'gid'))
 def street_add(request, gid):
     if request.method == 'POST':
         frm = forms.AbonStreetForm(request.POST)
@@ -788,6 +781,7 @@ def street_add(request, gid):
 
 @login_required
 @permission_required('abonapp.change_abonstreet')
+@permission_required('abonapp.can_view_abongroup', (models.AbonGroup, 'pk', 'gid'))
 def street_edit(request, gid):
     try:
         if request.method == 'POST':
@@ -812,6 +806,7 @@ def street_edit(request, gid):
 
 @login_required
 @permission_required('abonapp.delete_abonstreet')
+@permission_required('abonapp.can_view_abongroup', (models.AbonGroup, 'pk', 'gid'))
 def street_del(request, gid, sid):
     try:
         models.AbonStreet.objects.get(pk=sid, group=gid).delete()
@@ -823,6 +818,7 @@ def street_del(request, gid, sid):
 
 @login_required
 @permission_required('abonapp.can_view_additionaltelephones')
+@permission_required('abonapp.can_view_abongroup', (models.AbonGroup, 'pk', 'gid'))
 def tels(request, gid, uid):
     abon = get_object_or_404(models.Abon, pk=uid)
     telephones = abon.additional_telephones.all()

dialing_app/views.py

@@ -2,6 +2,7 @@ from django.contrib.auth.decorators import login_required
 from django.contrib import messages
 from django.shortcuts import render, redirect
 from django.utils.translation import ugettext_lazy as _
+from guardian.decorators import permission_required_or_403 as permission_required
 
 from abonapp.models import Abon
 from mydefs import only_admins, pag_mn
@@ -9,6 +10,7 @@ from .models import AsteriskCDR
 
 
 @login_required
+@permission_required('dialing_app.change_asteriskcdr')
 @only_admins
 def home(request):
     logs = AsteriskCDR.objects.exclude(userfield='request').order_by('-calldate')

templates/base.html

@@ -63,11 +63,13 @@
                     <span class="glyphicon glyphicon-envelope"></span> внутренняя переписка
 		</a></li>-->
 
+            {% if perms.dialing_app.change_asteriskcdr %}
             {% url 'dialapp:home' as dialhome %}
             <li{% if dialhome in request.path %} class="active"{% endif %}>
                 <a href="{{ dialhome }}">
                     <span class="glyphicon glyphicon-phone-alt"></span> Телефония
                 </a></li>
+            {% endif %}
 
             {% url 'devapp:group_list' as devapp_groups %}
             <li{% if devapp_groups in request.path %} class="active"{% endif %}>