Yes is download instead of view. <span></span><br><br>Il martedì 5 maggio 2015, Vladimiro Bellini <<a href="mailto:vlasvlasvlas@gmail.com">vlasvlasvlas@gmail.com</a>> ha scritto:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div>Did you meant:</div><div><br></div><div>replacing this (lines 593,594,595):</div><div><br></div><div><div><font face="monospace, monospace" style="background-color:rgb(244,204,204)">if not request.user.has_perm(</font></div><div><font face="monospace, monospace" style="background-color:rgb(244,204,204)"> '<b>view_resourcebase</b>',</font></div><div><font face="monospace, monospace" style="background-color:rgb(244,204,204)"> obj=ownable_layer.get_self_resource()):</font></div></div><div><br></div><div><br></div><div>with this? (lines 593,594,595):</div><div><br></div><div><div><font face="monospace, monospace" style="background-color:rgb(217,234,211)">if not request.user.has_perm(</font></div><div><span style="background-color:rgb(217,234,211)"><font face="monospace, monospace"> '</font><span style="font-size:12.8000001907349px"><font face="monospace, monospace"><b>download_resourcebase</b></font></span><font face="monospace, monospace">',</font></span></div><div><font face="monospace, monospace" style="background-color:rgb(217,234,211)"> obj=ownable_layer.get_self_resource()):</font></div></div><div><font face="monospace, monospace"><br></font></div><div><font face="monospace, monospace"><br></font></div><div><br></div><div><br></div><div><br></div></div><div class="gmail_extra"><br clear="all"><div><div><div dir="ltr">Vladimiro Bellini __<br><font face="'courier new', monospace">\ /| _ _|. _ . _ |__) _||. _ .</font></div></div></div>
<br><div class="gmail_quote">2015-05-05 14:16 GMT-03:00 Vladimiro Bellini <span dir="ltr"><<a href="javascript:_e(%7B%7D,'cvml','vlasvlasvlas@gmail.com');" target="_blank">vlasvlasvlas@gmail.com</a>></span>:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Hi! thanks, <div>ummmmmmmmm exactly what lines do i need to change at views.py? txs!</div></div><div class="gmail_extra"><br clear="all"><div><div><div dir="ltr">Vladimiro Bellini __<br><font face="'courier new', monospace">\ /| _ _|. _ . _ |__) _||. _ .</font></div></div></div>
<br><div class="gmail_quote">2015-05-05 13:12 GMT-03:00 Simone Dalmasso <span dir="ltr"><<a href="javascript:_e(%7B%7D,'cvml','simone.dalmasso@gmail.com');" target="_blank">simone.dalmasso@gmail.com</a>></span>:<div><div><br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Hi Vladimiro!<div>Good catch, it looks that we implemented the permissions for layers but not the check on map download see here <a href="https://github.com/GeoNode/geonode/blob/master/geonode/maps/views.py#L593" target="_blank">https://github.com/GeoNode/geonode/blob/master/geonode/maps/views.py#L593</a>. We are also missing a test then.</div><div>To fix that is enough to add </div><div><div><i>or not request.user.has_perm('download_resourcebase',obj=ownable_layer.get_self_resource())</i></div></div><div>We will fix this soon in master.</div><div>Thanks again for reporting!</div></div><div class="gmail_extra"><br><div class="gmail_quote"><div><div>2015-05-05 17:55 GMT+02:00 Vladimiro Bellini <span dir="ltr"><<a href="javascript:_e(%7B%7D,'cvml','vlasvlasvlas@gmail.com');" target="_blank">vlasvlasvlas@gmail.com</a>></span>:<br></div></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div><div dir="ltr">Hi!<div><br></div><div>i'm having some user-groups security issue...</div><div><br></div><div>i installed geonode 2.4 (ubuntu 14)</div><div><br></div><div>i have 1 all-allow private group with 1 all-allow user ,</div><div><br></div><div>and 1 all-deny group with 1 all-deny user.</div><div><br></div><div>I have this issue:</div><div><br></div><div>1- using the all-allow user, i upload a shapefile, and i set public view only (all other permissions just for his own user)</div><div><br></div><div>2- logging as the all-deny user, i do see the uploaded layer, thats correct because i chose that "everyone can see this layer, but they cannot download it"</div><div><br></div><div>3- using the same all-deny user, i create a map using the can-view cannot-download layer.</div><div><br></div><div>4- Then click on my created map and choose "download map" and choose "download data layer", then i click on "start map download".. and yes.. there's the problem, being a "you cannot download" user, i just downloaded the "view only" layer by creating a map with it.</div><div><br></div><div><br></div><div>how can this be resolved? </div><div><br></div><div>thanks!</div><div>if you need screenshots i can make them!</div><div><br></div><div>
</div></div>
<br></div></div>_______________________________________________<br>
geonode-users mailing list<br>
<a href="javascript:_e(%7B%7D,'cvml','geonode-users@lists.osgeo.org');" target="_blank">geonode-users@lists.osgeo.org</a><br>
<a href="http://lists.osgeo.org/cgi-bin/mailman/listinfo/geonode-users" target="_blank">http://lists.osgeo.org/cgi-bin/mailman/listinfo/geonode-users</a><br>
<br></blockquote></div><span><font color="#888888"><br><br clear="all"><div><br></div>-- <br><div>Simone </div>
</font></span></div>
</blockquote></div></div></div><br></div>
</blockquote></div><br></div>
</blockquote><br><br>-- <br>Simone <br>