← Back to branch summary

~azzar1/unity/add-show-desktop-key

« back to all changes in this revision

Viewing changes to ivle/webapp/admin/offeringservice.py

  • Committer: William Grant
  • Date: 2009-12-02 02:20:57 UTC
  • mto: This revision was merged to the branch mainline in revision 1353.
  • Revision ID: grantw@unimelb.edu.au-20091202022057-m3w3rzrzp47y89to
Refuse to traverse through an object to which the user has no permissions. This stops information leakage in breadcrumbs.

Show diffs side-by-side

added added

removed removed

Lines of Context:
ivle/webapp/admin/offeringservice.py
15
15
 
16
16
    template = "subject.html"
17
17
 
18
 
    def __init__(self, req, subject, year, semester):
19
 
 
20
 
        self.context = req.store.find(Offering,
21
 
                Offering.subject_id == Subject.id,
22
 
                Subject.short_name == unicode(subject),
23
 
                Offering.semester_id == Semester.id,
24
 
                Semester.year == unicode(year),
25
 
                Semester.semester == unicode(semester)).one()
26
 
 
27
 
        if self.context is None:
28
 
            raise NotFound()
29
 
 
30
18
    def new_project_url(self, projectset):
31
19
        return "/api/subjects/" + str(self.context.subject.id) + "/" +\
32
20
               self.context.semester.year + "/" +\