====

[plcapi.git] / PLC / Persons.py

diff --git a/PLC/Persons.py b/PLC/Persons.py
index 8813718..8cd2856 100644 (file)
--- a/PLC/Persons.py
+++ b/PLC/Persons.py
@@ -16,7 +16,6 @@ import re
 import crypt
 
 from PLC.Faults import *
 import crypt
 
 from PLC.Faults import *

-from PLC.Debug import log

 from PLC.Parameter import Parameter, Mixed
 from PLC.Filter import Filter
 from PLC.Table import Row, Table
 from PLC.Parameter import Parameter, Mixed
 from PLC.Filter import Filter
 from PLC.Table import Row, Table


@@ -78,7 +77,7 @@ class Person(Row):
         Validate email address. Stolen from Mailman.
         """
         email = email.lower()
         Validate email address. Stolen from Mailman.
         """
         email = email.lower()

-        invalid_email = PLCInvalidArgument("Invalid e-mail address")
+        invalid_email = PLCInvalidArgument("Invalid e-mail address %s"%email)

 
         if not email:
             raise invalid_email
 
         if not email:
             raise invalid_email


@@ -143,8 +142,8 @@ class Person(Row):
 
         if 'pi' in self['roles']:
             if set(self['site_ids']).intersection(person['site_ids']):
 
         if 'pi' in self['roles']:
             if set(self['site_ids']).intersection(person['site_ids']):

-                # Can update person is neither a PI or ADMIN
-                return (not (('pi' in person['roles']) or ('admin' in person['roles'])))
+                # non-admin users cannot update a person who is neither a PI or ADMIN
+                return (not set(['pi','admin']).intersection(person['roles']))

 
         return False
 
 
         return False
 


@@ -163,10 +162,10 @@ class Person(Row):
         if self.can_update(person):
             return True
 
         if self.can_update(person):
             return True
 

-        if 'pi' in self['roles'] or 'tech' in self['roles']:
+        # pis and techs can see all people on their site
+        if set(['pi','tech']).intersection(self['roles']):

             if set(self['site_ids']).intersection(person['site_ids']):
             if set(self['site_ids']).intersection(person['site_ids']):

-                # Can view people with equal or higher role IDs
-                return 'admin' not in person['roles']
+                return True

 
         return False
 
 
         return False
 


@@ -393,7 +392,8 @@ class Persons(Table):
                 person_filter = Filter(Person.fields, {'person_id': ints, 'email': strs})
                 sql += " AND (%s) %s" % person_filter.sql(api, "OR")
             elif isinstance(person_filter, dict):
                 person_filter = Filter(Person.fields, {'person_id': ints, 'email': strs})
                 sql += " AND (%s) %s" % person_filter.sql(api, "OR")
             elif isinstance(person_filter, dict):

-                person_filter = Filter(Person.fields, person_filter)
+                allowed_fields=dict(Person.fields.items()+Person.tags.items())
+                person_filter = Filter(allowed_fields, person_filter)

                 sql += " AND (%s) %s" % person_filter.sql(api, "AND")
             elif isinstance (person_filter, StringTypes):
                 person_filter = Filter(Person.fields, {'email':person_filter})
                 sql += " AND (%s) %s" % person_filter.sql(api, "AND")
             elif isinstance (person_filter, StringTypes):
                 person_filter = Filter(Person.fields, {'email':person_filter})