Question

I have those variables:

PERM_READ = 0x01
PERM_WRITE = 0x02
PERM_CMDS = 0x04

and a function that check the permission on a network or on a sensor. A function that determines what is the permission of the user.

This is the function:

def check_network_access(self, network, access=None, raise_err=True):
    if access is None:
        access = PERM_READ
    else:
        assert(access > 0)
        assert(access <= (PERM_READ + PERM_WRITE + PERM_CMDS))
    usr = self.get_current_user()
    usr_id = usr['id']
    # Does the network exist?
    net = self.get_network(network)
    if not net:
        raise tornado.web.HTTPError(404, "not found")

    self.lock_tables('read', ['nets_permissions'])
    perms = self.db.get("SELECT * FROM nets_permissions WHERE network_id=%s AND \
                        user_id=%s", network, usr_id)
    self.unlock_tables()
    if (not perms) or ((perms['perm'] & access) != access):
        if (raise_err):
            raise tornado.web.HTTPError(403, "access forbidden")
        else: 
            return False
    return True

Now for example i have an error when I call a page with this handler:

class NetworkStatusHandler(BaseHandler):
# Requires authentication 
@tornado.web.authenticated
def get(self, nid):

    # Retrieve the current user 
    usr = self.get_current_user()
    usr_id = usr['id']

    perm = self.db.query("SELECT n.perm FROM nets_permissions as n \
                          WHERE n.network_id=%s AND n.user_id=%s", nid, int(usr_id))

    # Check whether the user has access to the network 
    perms = self.check_network_access(nid, perm)
    net = self.get_network(nid)
    # Render the networks page
    self.render("networkstatus.html", net=net)

The error I have is:

Traceback (most recent call last):
  File "/usr/lib/python2.6/site-packages/tornado/web.py", line 988, in _execute
    getattr(self, self.request.method.lower())(*args, **kwargs)
  File "/usr/lib/python2.6/site-packages/tornado/web.py", line 1739, in wrapper
    return method(self, *args, **kwargs)
  File "./wsn.py", line 663, in get
    perms = self.check_network_access(nid, perm)
  File "./wsn.py", line 250, in check_network_access
    assert(access <= (PERM_READ + PERM_WRITE + PERM_CMDS))
AssertionError

I think this is a problem in the casting of the variable perm, when it’s passed to the check_network_access function…

Thank you for the help!

Answer 1

You need to use self.db.get instead of self.db.query. Something like the following should work:

class NetworkStatusHandler(BaseHandler):
# Requires authentication 
@tornado.web.authenticated
def get(self, nid):

    # Retrieve the current user 
    usr = self.get_current_user()
    usr_id = usr['id']

    row = self.db.get("SELECT n.perm FROM nets_permissions as n \
                          WHERE n.network_id=%s AND n.user_id=%s", nid, int(usr_id))
    perm = row['n.perm']

    # Check whether the user has access to the network 
    perms = self.check_network_access(nid, perm)
    net = self.get_network(nid)
    # Render the networks page
    self.render("networkstatus.html", net=net)

I hope this helps.