Use expandOwner/expandAdmin rather than removed expandLocker

[invirt/packages/invirt-web.git] / code / validation.py

diff --git a/code/validation.py b/code/validation.py
index fc9b969..29cb310 100755 (executable)
--- a/code/validation.py
+++ b/code/validation.py
@@ -5,6 +5,7 @@ import getafsgroups
 import re
 import string
 import dns.resolver
 import re
 import string
 import dns.resolver

+from invirt import authz

 from invirt.database import Machine, NIC, Type, Disk, CDROM, Autoinstall, Owner
 from invirt.config import structs as config
 from invirt.common import InvalidInput, CodeError
 from invirt.database import Machine, NIC, Type, Disk, CDROM, Autoinstall, Owner
 from invirt.config import structs as config
 from invirt.common import InvalidInput, CodeError

@@ -129,7 +130,7 @@ def haveAccess(user, state, machine):
 
 def owns(user, machine):
     """Return whether a user owns a machine"""
 
 def owns(user, machine):
     """Return whether a user owns a machine"""

-    return user in expandLocker(machine.owner)
+    return user in authz.expandOwner(machine.owner)

 
 def validMachineName(name):
     """Check that name is valid for a machine name"""
 
 def validMachineName(name):
     """Check that name is valid for a machine name"""

@@ -222,7 +223,7 @@ def testAdmin(user, admin, machine):
             return admin
         admin = 'system:' + admin
     try:
             return admin
         admin = 'system:' + admin
     try:

-        if user in getafsgroups.getAfsGroupMembers(admin, config.authz.cells[0].cell):
+        if user in getafsgroups.getAfsGroupMembers(admin, config.authz.afs.cells[0].cell):

             return admin
     except getafsgroups.AfsProcessError, e:
         errmsg = str(e)
             return admin
     except getafsgroups.AfsProcessError, e:
         errmsg = str(e)

@@ -244,7 +245,7 @@ def testOwner(user, owner, machine=None):
     if '@' in owner:
         raise InvalidInput('owner', owner, "No cross-realm Hesiod lockers allowed")
     try:
     if '@' in owner:
         raise InvalidInput('owner', owner, "No cross-realm Hesiod lockers allowed")
     try:

-        if user not in cache_acls.expandLocker(owner):
+        if user not in authz.expandOwner(owner):

             raise InvalidInput('owner', owner, 'You do not have access to the '
                                + owner + ' locker')
     except getafsgroups.AfsProcessError, e:
             raise InvalidInput('owner', owner, 'You do not have access to the '
                                + owner + ' locker')
     except getafsgroups.AfsProcessError, e: