Merge remote-tracking branch 'origin/master' into 3444-datatables-view

README.rst

@@ -74,7 +74,7 @@ others, make a new page on the `CKAN wiki`_, and tell us about it on
 Copying and License
 -------------------
 
-This material is copyright (c) 2006-2014 Open Knowledge Foundation.
+This material is copyright (c) 2006-2017 Open Knowledge International and contributors.
 
 It is open and licensed under the GNU Affero General Public License (AGPL) v3.0
 whose full text may be found at:

ckan/config/deployment.ini_tmpl

@@ -159,6 +159,7 @@ ckan.feeds.author_link =
 
 #ckan.datapusher.formats = csv xls xlsx tsv application/csv application/vnd.ms-excel application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
 #ckan.datapusher.url = http://127.0.0.1:8800/
+#ckan.datapusher.assume_task_stale_after = 3600
 
 # Resource Proxy settings
 # Preview size limit, default: 1MB

ckan/config/middleware/flask_app.py

@@ -1,7 +1,6 @@
 # encoding: utf-8
 
 import os
-import importlib
 import inspect
 import itertools
 import pkgutil
@@ -13,7 +12,6 @@
 from werkzeug.exceptions import HTTPException
 from werkzeug.routing import Rule
 
-from flask_debugtoolbar import DebugToolbarExtension
 
 from beaker.middleware import SessionMiddleware
 from paste.deploy.converters import asbool
@@ -70,6 +68,7 @@ def make_flask_stack(conf, **app_conf):
                            ' with the SECRET_KEY config option')
 
     if debug:
+        from flask_debugtoolbar import DebugToolbarExtension
         app.config['DEBUG_TB_INTERCEPT_REDIRECTS'] = False
         DebugToolbarExtension(app)
 

ckan/controllers/group.py

@@ -382,13 +382,16 @@ def bulk_process(self, id):
         data_dict = {'id': id, 'type': group_type}
 
         try:
+            self._check_access('bulk_update_public', context, {'org_id': id})
             # Do not query for the group datasets when dictizing, as they will
             # be ignored and get requested on the controller anyway
             data_dict['include_datasets'] = False
             c.group_dict = self._action('group_show')(context, data_dict)
             c.group = context['group']
-        except (NotFound, NotAuthorized):
+        except NotFound:
             abort(404, _('Group not found'))
+        except NotAuthorized:
+            abort(403, _('User %r not authorized to edit %s') % (c.user, id))
 
         if not c.group_dict['is_organization']:
             # FIXME: better error
@@ -634,14 +637,21 @@ def members(self, id):
                    'user': c.user}
 
         try:
+            data_dict = {'id': id}
+            check_access('group_edit_permissions', context, data_dict)
             c.members = self._action('member_list')(
                 context, {'id': id, 'object_type': 'user'}
             )
-            data_dict = {'id': id}
             data_dict['include_datasets'] = False
             c.group_dict = self._action('group_show')(context, data_dict)
-        except (NotFound, NotAuthorized):
+        except NotFound:
             abort(404, _('Group not found'))
+        except NotAuthorized:
+            abort(
+                403,
+                _('User %r not authorized to edit members of %s') % (
+                    c.user, id))
+
         return self._render_template('group/members.html', group_type)
 
     def member_new(self, id):

ckan/controllers/package.py

@@ -390,11 +390,14 @@ def read(self, id):
         try:
             return render(template,
                           extra_vars={'dataset_type': package_type})
-        except ckan.lib.render.TemplateNotFound:
-            msg = _("Viewing {package_type} datasets in {format} format is "
-                    "not supported (template file {file} not found).".format(
-                        package_type=package_type, format=format,
-                        file=template))
+        except ckan.lib.render.TemplateNotFound as e:
+            msg = _(
+                "Viewing datasets of type \"{package_type}\" is "
+                "not supported ({file_!r}).".format(
+                    package_type=package_type,
+                    file_=e.message
+                )
+            )
             abort(404, msg)
 
         assert False, "We should never get here"