Add permission for changes CSV download

Fixes #817
Signed-off-by: Michal Čihař <michal@cihar.com>

docs/admin/access.rst

@@ -85,6 +85,8 @@ Can edit priority [Managers, Owners]
     Can adjust source string priority
 Can edit check flags [Managers, Owners]
     Can adjust source string check flags
+Can download changes [Managers, Owners]
+    Can download changes in a CSV format.
 
 .. _acl:
 

weblate/accounts/models.py

@@ -779,6 +779,7 @@ def create_groups(update):
         Permission.objects.get(codename='edit_priority'),
         Permission.objects.get(codename='edit_flags'),
         Permission.objects.get(codename='manage_acl'),
+        Permission.objects.get(codename='download_changes'),
     )
 
     group, created = Group.objects.get_or_create(name='Managers')

weblate/html/trans/change_list.html

 {% extends "base.html" %}
 {% load i18n %}
 {% load translations %}
+{% load permissions %}
 
 {% block breadcrumbs %}
 <li><a href="{% url 'changes' %}">{% trans "Changes" %}</a></li>
@@ -8,16 +9,22 @@
 
 {% block content %}
 
+{% can_download_changes user project as user_can_download_changes %}
+
+{% if user_can_download_changes or changes_rss %}
 <ul class="pagination pull-right flip">
+{% if user_can_download_changes %}
 <li>
 <a href="{% url 'changes-csv' %}?{{ query_string }}" title="{% trans "Download all changes as CSV" %}"><i class="fa fa-download"></i></a>
 </li>
+{% endif %}
 {% if changes_rss %}
 <li>
 <a href="{{ changes_rss }}" title="{% trans "Follow using RSS" %}"><i class="fa fa-rss"></i></a>
 </li>
 {% endif %}
 </ul>
+{% endif %}
 
 {% include "paginator.html" %}
 

weblate/trans/migrations/0045_auto_20150916_1007.py

+# -*- coding: utf-8 -*-
+from __future__ import unicode_literals
+
+from django.db import models, migrations
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('trans', '0044_auto_20150916_0952'),
+    ]
+
+    operations = [
+        migrations.AlterModelOptions(
+            name='change',
+            options={'ordering': ['-timestamp'], 'permissions': (('download_changes', 'Can download changes'),)},
+        ),
+    ]

weblate/trans/models/changes.py

@@ -239,6 +239,9 @@ class Change(models.Model):
     class Meta(object):
         ordering = ['-timestamp']
         app_label = 'trans'
+        permissions = (
+            ('download_changes', "Can download changes"),
+        )
 
     def __unicode__(self):
         return _('%(action)s at %(time)s on %(translation)s by %(user)s') % {

weblate/trans/permissions.py

@@ -253,3 +253,11 @@ def can_manage_acl(user, project):
     Checks whether user can manage ACL on given project.
     """
     return check_permission(user, project, 'trans.manage_acl')
+
+
+@cache_permission
+def can_download_changes(user, project):
+    """
+    Checks whether user can download CSV for changes on given project.
+    """
+    return check_permission(user, project, 'trans.download_changes')

weblate/trans/templatetags/permissions.py

@@ -116,3 +116,8 @@ def can_delete_comment(user, project):
 @register.assignment_tag
 def can_manage_acl(user, project):
     return weblate.trans.permissions.can_manage_acl(user, project)
+
+
+@register.assignment_tag
+def can_download_changes(user, project):
+    return weblate.trans.permissions.can_download_changes(user, project)

weblate/trans/views/changes.py

@@ -25,9 +25,12 @@ from django.contrib.auth.models import User
 from django.utils.translation import ugettext as _, activate
 from django.core.urlresolvers import reverse
 from django.db.models import Q
+from django.core.exceptions import PermissionDenied
+
 from weblate.trans.models.changes import Change
 from weblate.trans.views.helper import get_project_translation
 from weblate.lang.models import Language
+from weblate.trans.permissions import can_download_changes
 from urllib import urlencode
 import csv
 
@@ -55,6 +58,7 @@ class ChangesView(ListView):
             **kwargs
         )
         context['title'] = _('Changes')
+        context['project'] = self.project
 
         url = {}
 
@@ -205,6 +209,9 @@ class ChangesCSVView(ChangesView):
     def get(self, request, *args, **kwargs):
         object_list = self.get_queryset()
 
+        if not can_download_changes(request.user, self.project):
+            raise PermissionDenied()
+
         # Always output in english
         activate('en')