Commit 3f3c9033 by benjaoming

Fix #173 by letting articles refer to other article's attachments while checking…

Fix #173 by letting articles refer to other article's attachments while checking the permissions of the original article owner
parents 00903359 b9981cf6
......@@ -4,6 +4,7 @@ import re
from django.core.urlresolvers import reverse
from django.template.context import Context
from django.template.loader import render_to_string
from wiki.core.permissions import can_read
ATTACHMENT_RE = re.compile(r'(?P<before>.*)(\[attachment\:(?P<id>\d+)\])(?P<after>.*)', re.IGNORECASE)
......@@ -28,13 +29,27 @@ class AttachmentPreprocessor(markdown.preprocessors.Preprocessor):
before = m.group('before')
after = m.group('after')
try:
attachment = models.Attachment.objects.get(articles=self.markdown.article,
id=attachment_id, current_revision__deleted=False)
attachment = models.Attachment.objects.get(
articles__current_revision__deleted=False,
id=attachment_id, current_revision__deleted=False
)
url = reverse('wiki:attachments_download', kwargs={'article_id': self.markdown.article.id,
'attachment_id':attachment.id,})
html = render_to_string("wiki/plugins/attachments/render.html",
Context({'url': url,
'filename': attachment.original_filename,}))
# The readability of the attachment is decided relative
# to the owner of the original article.
# I.e. do not insert attachments in other articles that
# the original uploader cannot read, that would be out
# of scope!
attachment_can_read = can_read( self.markdown.article,
attachment.article.owner)
html = render_to_string(
"wiki/plugins/attachments/render.html",
Context({
'url': url,
'filename': attachment.original_filename,
'attachment_can_read': attachment_can_read,
}))
line = self.markdown.htmlStash.store(html, safe=True)
except models.Attachment.DoesNotExist:
line = line.replace(m.group(1), u"""<span class="attachment attachment-deleted">Attachment with ID #%s is deleted.</span>""" % attachment_id)
......
......@@ -2,4 +2,8 @@
{% comment %}
Render an attachment to HTML in the markdown extension
{% endcomment %}
{% if not attachment_can_read %}
<em>{% trans "This attachment is not permitted on this page." %}</em>
{% else %}
<span class="attachment"><a href="{{ url }}" title="{% trans "Click to download" %} {{ filename }}">{{ filename }}</a>
{% endif %}
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment