dojo/object/views.py - master - Art86/DefectDojo-DevSecOps

dojo/object/views.py
116 строк4 KB
Greg Anderson
Updates Decorators with Certain Permission Models (#14410)
02 мар 2026, 19:13
02 мар 2026, 19:131267c72
import logging

from django.contrib import messages
from django.core.exceptions import PermissionDenied
from django.http import HttpResponseRedirect
from django.shortcuts import get_object_or_404, render
from django.urls import reverse

from dojo.authorization.authorization_decorators import user_is_authorized
from dojo.authorization.roles_permissions import Permissions
from dojo.forms import DeleteObjectsSettingsForm, ObjectSettingsForm
from dojo.labels import get_labels
from dojo.models import Objects_Product, Product
from dojo.utils import Product_Tab

logger = logging.getLogger(__name__)

labels = get_labels()


@user_is_authorized(Product, Permissions.Product_Tracking_Files_Add, "pid")
def new_object(request, pid):
    page_name = labels.ASSET_TRACKED_FILES_ADD_LABEL
    prod = get_object_or_404(Product, id=pid)
    if request.method == "POST":
        tform = ObjectSettingsForm(request.POST)
        if tform.is_valid():
            new_prod = tform.save(commit=False)
            new_prod.product = prod
            new_prod.save()

            messages.add_message(request,
                                 messages.SUCCESS,
                                 labels.ASSET_TRACKED_FILES_ADD_SUCCESS_MESSAGE,
                                 extra_tags="alert-success")
            return HttpResponseRedirect(reverse("view_objects", args=(pid,)))
        return None
    tform = ObjectSettingsForm()
    product_tab = Product_Tab(prod, title=str(page_name), tab="settings")

    return render(request, "dojo/new_object.html",
                  {
                   "name": page_name,
                   "tform": tform,
                   "product_tab": product_tab,
                   "pid": prod.id})


@user_is_authorized(Product, Permissions.Product_Tracking_Files_View, "pid")
def view_objects(request, pid):
    product = get_object_or_404(Product, id=pid)
    object_queryset = Objects_Product.objects.filter(product=pid).order_by("path", "folder", "artifact")

    product_tab = Product_Tab(product, title="Tracked Files, Paths and Artifacts", tab="settings")
    return render(request,
                  "dojo/view_objects.html",
                  {
                      "object_queryset": object_queryset,
                      "product_tab": product_tab,
                      "product": product,
                  })


@user_is_authorized(Product, Permissions.Product_Tracking_Files_Edit, "pid")
def edit_object(request, pid, ttid):
    object_prod = get_object_or_404(Objects_Product, pk=ttid)
    product = get_object_or_404(Product, id=pid)
    if object_prod.product != product:
        raise PermissionDenied

    if request.method == "POST":
        tform = ObjectSettingsForm(request.POST, instance=object_prod)
        if tform.is_valid():
            tform.save()

            messages.add_message(request,
                                 messages.SUCCESS,
                                 "Tracked File Successfully Updated.",
                                 extra_tags="alert-success")
            return HttpResponseRedirect(reverse("view_objects", args=(pid,)))
    else:
        tform = ObjectSettingsForm(instance=object_prod)

    product_tab = Product_Tab(product, title="Edit Tracked Files", tab="settings")
    return render(request,
                  "dojo/edit_object.html",
                  {
                      "tform": tform,
                      "product_tab": product_tab,
                  })


@user_is_authorized(Product, Permissions.Product_Tracking_Files_Delete, "pid")
def delete_object(request, pid, ttid):
    object_prod = get_object_or_404(Objects_Product, pk=ttid)
    product = get_object_or_404(Product, id=pid)
    if object_prod.product != product:
        raise PermissionDenied

    if request.method == "POST":
        tform = ObjectSettingsForm(request.POST, instance=object_prod)
        object_prod.delete()
        messages.add_message(request,
                             messages.SUCCESS,
                             "Tracked Files Deleted.",
                             extra_tags="alert-success")
        return HttpResponseRedirect(reverse("view_objects", args=(pid,)))
    tform = DeleteObjectsSettingsForm(instance=object_prod)

    product_tab = Product_Tab(product, title="Delete Tracked File", tab="settings")
    return render(request,
                  "dojo/delete_object.html",
                  {
                      "tform": tform,
                      "product_tab": product_tab,
                  })