Mirror
/
zulip
mirror of https://github.com/zulip/zulip.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

ldap: Remove unused isinstance check. 

`realm_access_control` is always a `dict`.

Signed-off-by: Zixuan James Li <p359101898@gmail.com>
This commit is contained in:
Zixuan James Li 2022-07-07 16:28:24 -04:00 committed by Tim Abbott
parent d3f2203459
commit 3a27a60b2c
1 changed files with 4 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
zproject/backends.py
View File

@ -776,6 +776,7 @@ class ZulipLDAPAuthBackendBase(ZulipAuthMixin, LDAPBackend):
return attr_value_upper in true_values return attr_value_upper in true_values
def is_account_realm_access_forbidden(self, ldap_user: _LDAPUser, realm: Realm) -> bool: def is_account_realm_access_forbidden(self, ldap_user: _LDAPUser, realm: Realm) -> bool:
realm_access_control = settings.AUTH_LDAP_ADVANCED_REALM_ACCESS_CONTROL
# org_membership takes priority over AUTH_LDAP_ADVANCED_REALM_ACCESS_CONTROL. # org_membership takes priority over AUTH_LDAP_ADVANCED_REALM_ACCESS_CONTROL.
if "org_membership" in settings.AUTH_LDAP_USER_ATTR_MAP: if "org_membership" in settings.AUTH_LDAP_USER_ATTR_MAP:
org_membership_attr = settings.AUTH_LDAP_USER_ATTR_MAP["org_membership"] org_membership_attr = settings.AUTH_LDAP_USER_ATTR_MAP["org_membership"]
@ -783,20 +784,18 @@ class ZulipLDAPAuthBackendBase(ZulipAuthMixin, LDAPBackend):
if is_subdomain_in_allowed_subdomains_list(realm.subdomain, allowed_orgs): if is_subdomain_in_allowed_subdomains_list(realm.subdomain, allowed_orgs):
return False return False
# If Advanced is not configured, forbid access # If Advanced is not configured, forbid access
if settings.AUTH_LDAP_ADVANCED_REALM_ACCESS_CONTROL is None: if realm_access_control is None:
return True return True
# If neither setting is configured, allow access. # If neither setting is configured, allow access.
if settings.AUTH_LDAP_ADVANCED_REALM_ACCESS_CONTROL is None: if realm_access_control is None:
return False return False
# With settings.AUTH_LDAP_ADVANCED_REALM_ACCESS_CONTROL, we # With settings.AUTH_LDAP_ADVANCED_REALM_ACCESS_CONTROL, we
# allow access if and only if one of the entries for the # allow access if and only if one of the entries for the
# target subdomain matches the user's LDAP attributes. # target subdomain matches the user's LDAP attributes.
realm_access_control = settings.AUTH_LDAP_ADVANCED_REALM_ACCESS_CONTROL
if not ( if not (
isinstance(realm_access_control, dict) realm.subdomain in realm_access_control
and realm.subdomain in realm_access_control
and isinstance(realm_access_control[realm.subdomain], list) and isinstance(realm_access_control[realm.subdomain], list)
and len(realm_access_control[realm.subdomain]) > 0 and len(realm_access_control[realm.subdomain]) > 0
): ):