Checks the desired permissions with user id and group id against the metadata of an iNode.
The desired permissions can be bitwise combinations of constants.R_OK, constants.W_OK and constants.X_OK.
972943
function checkPermissions (access: number, uid: number, gid: number, stat: Stat): boolean {
  return (access & resolveOwnership(uid, gid, stat)) === access;
}
585875
def has_perm(self, perm, obj, check_groups=True, approved=True):
        
        if self.user:
            if self.has_user_perms(perm, obj, approved, check_groups):
                return True
        if self.group:
            return self.has_group_perms(perm, obj, approved)
        return False
298497
def check_public_permissions(payload):
    """"""
    allowed_public_permissions = ['view', 'add', 'download']
    for perm_type in ['add', 'remove']:
        for perm in payload.get('public', {}).get(perm_type, []):
            if perm not in allowed_public_permissions:
                raise exceptions.PermissionDenied("Permissions for public users are too open")
410793
def _check_dir_meta(name,
                    user,
                    group,
                    mode,
                    follow_symlinks=False):
    '''
    
    '''
    try:
        stats = __salt__['file.stats'](name, None, follow_symlinks)
    except CommandExecutionError:
        stats = {}

    changes = {}
    if not stats:
        changes['directory'] = 'new'
        return changes
    if (user is not None
            and user != stats['user']
            and user != stats.get('uid')):
        changes['user'] = user
    if (group is not None
            and group != stats['group']
            and group != stats.get('gid')):
        changes['group'] = group
    # Normalize the dir mode
    smode = salt.utils.files.normalize_mode(stats['mode'])
    mode = salt.utils.files.normalize_mode(mode)
    if mode is not None and mode != smode:
        changes['mode'] = mode
    return changes
1292565
public void collectPermissionIds(AccessControlGroup group, Set<String> permissions) {

    boolean added = permissions.add(group.getId());
    if (!added) {
      // we have already visited this node, stop recursion...
      return;
    }
    for (AccessControlPermission permission : group.getPermissions()) {
      permissions.add(permission.getId());
    }
    for (AccessControlGroup inheritedGroup : group.getInherits()) {
      collectPermissionIds(inheritedGroup, permissions);
    }
  }
1250289
def get_permissions(self, user, obj=_nothing):
        
        rule = self._get_rule(obj)

        all_permissions = (
            attr[len('can_'):] for attr in dir(rule)
            if attr.startswith('can_')
        )

        return set(
            permission for permission in all_permissions
            if self.allows(user, permission, obj)
        )
190674
def check_permission_safety(path):
    
    f_stats = os.stat(path)
    return (f_stats.st_mode & (stat.S_IRWXG | stat.S_IRWXO)) == 0 and f_stats.st_uid == os.getuid()
1268273
public boolean checkPermission(Principal user, int operation) 
  {  
    if (tc.isEntryEnabled()) 
      SibTr.entry(tc, "checkPermission", new Object[]{user, new Integer(operation)});
    boolean allowed = false;
    
    if(operation == 1) // a publish operation
    {
      // check whether permission has been granted to special group Everyone. 
      // We can do this before we check whether the user is authenticated
      if(accumGroupAllowedToPublish.size() > 0
         && accumGroupAllowedToPublish.contains(everyone))
      {
        allowed = true;
      }
      // Now check whether the user is authenticated, ie we have a username
      else if (user.getName() != null 
               && user.getName().length() > 0)
      {
        // User is authenticated
                  
        // Check user list next
        if(accumUsersAllowedToPublish.size() > 0 &&
            accumUsersAllowedToPublish.contains(user))
        {
          allowed = true;
        }
        else // Now check the groups
        {
          if(accumGroupAllowedToPublish.size() > 0)
          {
            // user hasn't been granted access directly, check the groups
            // check for AllAuthenticated first     
            if (accumGroupAllowedToPublish.contains(allAuthenticated))
            {
              allowed = true;
            }
            else
            {              
              Iterator itr = accumGroupAllowedToPublish.iterator();
              while (itr.hasNext())
              {
                Group group = (Group)itr.next();
                if(group.isMember(user))
                {
                  allowed = true;
                  break;
                }
              } // eof while
            }
          }
        } 
      }
    }
    else // a subscribe operation
    {
      // check whether permission has been granted to special group Everyone. 
      // We can do this before we check whether the user is authenticated
      if(accumGroupAllowedToSubscribe.size() > 0
         && accumGroupAllowedToSubscribe.contains(everyone))
      {
        allowed = true;
      }
      // Now check whether the user is authenticated, ie we have a username
      else if (user.getName() != null 
               && user.getName().length() > 0)
      {
        // User is authenticated
                  
        // Check user list next        
        if(accumUsersAllowedToSubscribe.size() > 0 &&
           accumUsersAllowedToSubscribe.contains(user))
        {
          allowed = true;
        }
        else // Now check the groups
        {
          if(accumGroupAllowedToSubscribe.size() > 0)
          {
            // user hasn't been granted access directly, check the groups
            // check for AllAuthenticated first     
            if (accumGroupAllowedToSubscribe.contains(allAuthenticated))
            {
              allowed = true;
            }
            else
            {                       
              Iterator itr = accumGroupAllowedToSubscribe.iterator();
           
              while (itr.hasNext())
              {
                Group group = (Group)itr.next();
                if(group.isMember(user))
                {
                  allowed = true;
                  break;
                }
              }
            }
          } 
        } 
      }       
    }
    if (tc.isEntryEnabled()) SibTr.exit(tc, "checkPermission", new Boolean(allowed));
    return allowed;
  }
1230246
def filter_permissions(self, search):
        
        user = self.request.user
        if user.is_superuser:
            return search
        if user.is_anonymous:
            user = get_anonymous_user()

        filters = [Q('match', users_with_permissions=user.pk)]
        filters.extend([
            Q('match', groups_with_permissions=group.pk) for group in user.groups.all()
        ])
        filters.append(Q('match', public_permission=True))

        # `minimum_should_match` is set to 1 by default
        return search.query('bool', should=filters)
844650
def _get_group_cached_perms(self):
        
        if not self.group:
            return {}
        perms = Permission.objects.filter(
            group=self.group,
        )
        group_permissions = {}
        for perm in perms:
            group_permissions[(
                perm.object_id,
                perm.content_type_id,
                perm.codename,
                perm.approved,
            )] = True
        return group_permissions
134301
def group_perms_for_user(cls, instance, user, db_session=None):
        
        db_session = get_db_session(db_session, instance)
        perms = resource_permissions_for_users(
            cls.models_proxy,
            ANY_PERMISSION,
            resource_ids=[instance.resource_id],
            user_ids=[user.id],
            db_session=db_session,
        )
        perms = [p for p in perms if p.type == "group"]
        # include all perms if user is the owner of this resource
        groups_dict = dict([(g.id, g) for g in user.groups])
        if instance.owner_group_id in groups_dict:
            perms.append(
                PermissionTuple(
                    user,
                    ALL_PERMISSIONS,
                    "group",
                    groups_dict.get(instance.owner_group_id),
                    instance,
                    True,
                    True,
                )
            )
        return perms
956495
private void checkOwner(LockedInodePath inodePath)
      throws AccessControlException, InvalidPathException {
    // collects inodes info on the path
    List<InodeView> inodeList = inodePath.getInodeViewList();

    // collects user and groups
    String user = AuthenticatedClientUser.getClientUser(ServerConfiguration.global());
    List<String> groups = getGroups(user);

    if (isPrivilegedUser(user, groups)) {
      return;
    }

    checkInodeList(user, groups, null, inodePath.getUri().getPath(), inodeList, true);
  }
255739
def validate_permission(self, key, permission):
        
        if permission.perm_name not in self.__possible_permissions__:
            raise AssertionError(
                "perm_name is not one of {}".format(self.__possible_permissions__)
            )
        return permission
944968
def object_permission_set(self):
        ''''''
        return Or(
            AllowOnlySafeHttpMethod,
            AllowAdmin,
            And(
                AllowPermission('org:admin'),
                ObjAttrTrue(lambda _, u: not u.is_superuser),
                ObjAttrTrue(
                    lambda r, _: r.data.get('admin') is not True)
            ),
            And(
                AllowModify,
                ObjAttrTrue(
                    lambda req, user: user == req.user),
                ObjAttrTrue(
                    lambda r, _: r.data.get('admin') is not True)
            ),
        )
74452
def ensure_permissions(mode_flags=stat.S_IWUSR):
    

    def decorator(f):
        def modify(filename, *args, **kwargs):
            m = chmod_perms(filename) if exists(filename) else mode_flags
            if not m & mode_flags:
                os.chmod(filename, m | mode_flags)
            try:
                return f(filename, *args, **kwargs)
            finally:
                # restore original permissions
                if not m & mode_flags:
                    os.chmod(filename, m)
        return modify

    return decorator
809026
def requested_perm(self, perm, obj, check_groups=True):
        
        return self.has_perm(perm, obj, check_groups, False)
1354520
def check_rights_and_access(request, meta, project=None):
    """"""
    # User must be logged ?
    if ('only_logged_user' in meta and meta['only_logged_user']):
        if not request.user.is_authenticated():
            return gen403(request, baseURI, 'only_logged_user', project)

    # User must be member of the project ?
    if ('only_member_user' in meta and meta['only_member_user']):
        if not request.user.ebuio_member:
            return gen403(request, baseURI, 'only_member_user', project)

    # User must be administrator of the project ?
    if ('only_admin_user' in meta and meta['only_admin_user']):
        if not request.user.ebuio_admin:
            return gen403(request, baseURI, 'only_admin_user', project)

    # User must be member of the orga ?
    if ('only_orga_member_user' in meta and meta['only_orga_member_user']):
        if not request.user.ebuio_orga_member:
            return gen403(request, baseURI, 'only_orga_member_user', project)

    # User must be administrator of the orga ?
    if ('only_orga_admin_user' in meta and meta['only_orga_admin_user']):
        if not request.user.ebuio_orga_admin:
            return gen403(request, baseURI, 'only_orga_admin_user', project)

    # Remote IP must be in range ?
    if ('address_in_networks' in meta):
        if not is_requestaddress_in_networks(request, meta['address_in_networks']):
            return gen403(request, baseURI, 'address_in_networks', project)