From aad6251058e238bd3b30f8d3f3a47d2c340d31e2 Mon Sep 17 00:00:00 2001
From: Goffi <goffi@goffi.org>
Date: Tue, 4 Feb 2014 18:32:39 +0100
Subject: [PATCH] core: security limit in menus

---
 src/core/sat_main.py           | 7 +++++--
 src/plugins/plugin_xep_0050.py | 2 +-
 src/plugins/plugin_xep_0055.py | 2 +-
 src/plugins/plugin_xep_0100.py | 2 +-
 4 files changed, 8 insertions(+), 5 deletions(-)

diff --git a/src/core/sat_main.py b/src/core/sat_main.py
index cae221bb..573bc943 100644
--- a/src/core/sat_main.py
+++ b/src/core/sat_main.py
@@ -893,7 +893,7 @@ class SAT(service.Service):
             /!\ use D_() instead of _() for translations (e.g. (D_("File"), D_("Open")))
         @param callback: method to be called when menuitem is selected, callable or a callback id (string) as returned by [registerCallback]
         @param security_limit: %(doc_security_limit)s
-            /!\ security_limit MUST be added to data in launchCallback if used
+            /!\ security_limit MUST be added to data in launchCallback if used #TODO
         @param help_string: string used to indicate what the menu do (can be show as a tooltip).
             /!\ use D_() instead of _() for translations
         @param type: one of:
@@ -932,7 +932,7 @@ class SAT(service.Service):
 
         return callback_id
 
-    def getMenus(self, language='', security_limit = NO_SECURITY_LIMIT):
+    def getMenus(self, language='', security_limit=NO_SECURITY_LIMIT):
         """Return all menus registered
         @param language: language used for translation, or empty string for default
         @param security_limit: %(doc_security_limit)s
@@ -947,6 +947,9 @@ class SAT(service.Service):
         for menu_id, menu_data in self._menus.iteritems():
             type_ = menu_data['type']
             path = menu_data['path']
+            menu_security_limit = menu_data['security_limit']
+            if security_limit!=NO_SECURITY_LIMIT and (menu_security_limit==NO_SECURITY_LIMIT or menu_security_limit>security_limit):
+                continue
             languageSwitch(language)
             path_i18n = [_(elt) for elt in path]
             languageSwitch()
diff --git a/src/plugins/plugin_xep_0050.py b/src/plugins/plugin_xep_0050.py
index 159f5122..710134ac 100644
--- a/src/plugins/plugin_xep_0050.py
+++ b/src/plugins/plugin_xep_0050.py
@@ -212,7 +212,7 @@ class XEP_0050(object):
                               method=self._requestCommandsList,
                               async=True)
         self.__requesting_id = host.registerCallback(self._requestingEntity, with_data=True)
-        host.importMenu((D_("Service"), D_("commands")), self._commandsMenu, help_string=D_("Execute ad-hoc commands"))
+        host.importMenu((D_("Service"), D_("commands")), self._commandsMenu, security_limit=4, help_string=D_("Execute ad-hoc commands"))
 
     def getHandler(self, profile):
         return XEP_0050_handler(self)
diff --git a/src/plugins/plugin_xep_0055.py b/src/plugins/plugin_xep_0055.py
index 65d6b433..32905860 100644
--- a/src/plugins/plugin_xep_0055.py
+++ b/src/plugins/plugin_xep_0055.py
@@ -53,7 +53,7 @@ class XEP_0055(object):
         self._sessions = Sessions()
         self.__menu_cb_id = host.registerCallback(self._menuCb, with_data=True)
         self.__search_request_id = host.registerCallback(self._xmluiSearchRequest, with_data=True)
-        host.importMenu((D_("Communication"), D_("Search directory")), self._searchMenu, help_string=D_("Search use directory"))
+        host.importMenu((D_("Communication"), D_("Search directory")), self._searchMenu, security_limit=1, help_string=D_("Search use directory"))
 
     def _menuCb(self, data, profile):
         entity = jid.JID(data[xml_tools.SAT_FORM_PREFIX+'jid'])
diff --git a/src/plugins/plugin_xep_0100.py b/src/plugins/plugin_xep_0100.py
index 4badedf6..8afc8d01 100755
--- a/src/plugins/plugin_xep_0100.py
+++ b/src/plugins/plugin_xep_0100.py
@@ -62,7 +62,7 @@ class XEP_0100(object):
         host.bridge.addMethod("gatewayRegister", ".plugin", in_sign='ss', out_sign='s', method=self._gatewayRegister)
         self.__menu_id = host.registerCallback(self._gatewaysMenu, with_data=True)
         self.__selected_id = host.registerCallback(self._gatewaySelectedCb, with_data=True)
-        host.importMenu((D_("Service"), D_("gateways")), self._gatewaysMenu, help_string=D_("Find gateways"))
+        host.importMenu((D_("Service"), D_("gateways")), self._gatewaysMenu, security_limit=2, help_string=D_("Find gateways"))
 
 
     def _gatewaysMenu(self, data, profile):