Raise ``PermissionDenied`` if ``payload`` includes ``user_pk``.
490782
def check_user_permissions(payload, user_pk):
    """"""
    for perm_type in ['add', 'remove']:
        user_pks = payload.get('users', {}).get(perm_type, {}).keys()
        if user_pk in user_pks:
            raise exceptions.PermissionDenied("You cannot change your own permissions")
945189
def check_permissions(self, request):
        """"""
        objs = [None]
        if hasattr(self, 'get_perms_objects'):
            objs = self.get_perms_objects()
        else:
            if hasattr(self, 'get_object'):
                try:
                    objs = [self.get_object()]
                except Http404:
                    raise
                except:
                    pass
            if objs == [None]:
                objs = self.get_queryset()
            if len(objs) == 0:
                objs = [None]

        if (hasattr(self, 'permission_filter_queryset') and
           self.permission_filter_queryset is not False and
           self.request.method == 'GET'):
            if objs != [None]:
                self.perms_filter_queryset(objs)
        else:
            has_perm = check_perms(self.request.user,
                                   self.get_permission_required(),
                                   objs, self.request.method)

            if not has_perm:
                msg = self.get_permission_denied_message(
                    default="Permission denied."
                )
                if isinstance(msg, Sequence):
                    msg = msg[0]
                self.permission_denied(request, message=msg)
625484
def _get_permission_set_tree(user):
    
    if hasattr(user, CACHED_PSET_PROPERTY_KEY):
        return getattr(user, CACHED_PSET_PROPERTY_KEY)
    if user.is_authenticated():
        try:
            return user.permissionset.first().tree()
        except AttributeError:
            raise ObjectDoesNotExist
    return PermissionSet.objects.get(anonymous_user=True).tree()
651734
def user_is(role, get_user=import_user):
    
    def wrapper(func):
        @wraps(func)
        def inner(*args, **kwargs):
            from .models import Role
            current_user = get_user()
            if role in current_user.roles:
                return func(*args, **kwargs)
            raise Forbidden("You do not have access")
        return inner
    return wrapper
298497
def check_public_permissions(payload):
    """"""
    allowed_public_permissions = ['view', 'add', 'download']
    for perm_type in ['add', 'remove']:
        for perm in payload.get('public', {}).get(perm_type, []):
            if perm not in allowed_public_permissions:
                raise exceptions.PermissionDenied("Permissions for public users are too open")
904021
def authorize(self, request, *args, **kwargs):
        
        user = request.user
        if not user.is_authenticated or not user.socialaccount_set.exists():
            raise PermissionDenied()
359317
def perform_permissions_check(self, user, obj, perms):
        
        return self.request.forum_permission_handler.can_update_topics_to_normal_topics(obj, user)
509838
def check_perm(user_id, permission_code):
    
    try:
        perm = db.DBSession.query(Perm).filter(Perm.code==permission_code).one()
    except NoResultFound:
        raise PermissionError("Nonexistent permission type: %s"%(permission_code))


    try:
        res = db.DBSession.query(User).join(RoleUser, RoleUser.user_id==User.id).\
            join(Perm, Perm.id==perm.id).\
            join(RolePerm, RolePerm.perm_id==Perm.id).filter(User.id==user_id).one()
    except NoResultFound:
        raise PermissionError("Permission denied. User %s does not have permission %s"%
                        (user_id, permission_code))
380689
def perform_permissions_check(self, user, obj, perms):
        
        return self.request.forum_permission_handler.can_move_topics(obj, user)
944968
def object_permission_set(self):
        ''''''
        return Or(
            AllowOnlySafeHttpMethod,
            AllowAdmin,
            And(
                AllowPermission('org:admin'),
                ObjAttrTrue(lambda _, u: not u.is_superuser),
                ObjAttrTrue(
                    lambda r, _: r.data.get('admin') is not True)
            ),
            And(
                AllowModify,
                ObjAttrTrue(
                    lambda req, user: user == req.user),
                ObjAttrTrue(
                    lambda r, _: r.data.get('admin') is not True)
            ),
        )
424279
def superuser_only(view_func):
    
    def _inner(request, *args, **kwargs):
        if not request.user.is_superuser:
            raise PermissionDenied
        return view_func(request, *args, **kwargs)
    return _inner
1209190
def check_permissions(self, request):
        """"""

        if not self.predicates:
            return True

        # All registered authentication predicates must return True
        return all(
            predicate(request, *self.predicates_params[i])
            for i, predicate in enumerate(self.predicates)
        )
204869
def has_update_permission(self, request, obj):
        
        perm_string = '%s.change_%s' % (self.model._meta.app_label,
            self.model._meta.object_name.lower()
        )
        return request.user.has_perm(perm_string)
1218474
def grant_member(context, request):
    """"""
    mapping = request.json['mapping']
    for entry in mapping:
        user = entry['user']
        roles = entry['roles']
        username = user.get('username', None)
        userid = user.get('userid', None)
        if userid:
            u = context.get_user_by_userid(userid)
        elif username:
            u = context.get_user_by_username(username)
        else:
            u = None
        if u is None:
            raise UnprocessableError(
                'User %s does not exists' % (userid or username))
        for rolename in roles:
            context.grant_member_role(u.userid, rolename)
    return {'status': 'success'}
1313119
def perform_permissions_check(self, user, obj, perms):
        
        return self.request.forum_permission_handler.can_download_files(obj, user)
1170141
def permission_required_with_403(perm, login_url=None):
    
    return user_passes_test_with_403(lambda u: u.has_perm(perm), login_url=login_url)
378067
def assert_has_permission(self, scope_required):
        
        if not self.authenticated:
            raise ValueError("Must first authenticate()")

        if scope_required not in self.get_scopes():
            logging.warning("Authenticated as %s" % (self.client['id']))
            logging.warning("Have scopes: %s" % (str.join(',', self.get_scopes())))
            logging.warning("Insufficient scope %s for operation" % (scope_required))

            raise ValueError("Client does not have permission.")

        return True