allow to access nodes that are owned by the user even if no rights are defined

pboard/pboard/lib/auth.py

@@ -15,13 +15,24 @@ class can_read(Predicate):
             node_id = environ['webob.adhoc_attrs']['validation']['values']['node_id']
             if node_id!=0:
                 has_right = session.execute("""
-                        select *
-                        from pod_group_node pgn
+                    select
+                        node_id
+                    from
+                        pod_group_node pgn
                         join pod_user_group pug on pug.group_id = pgn.group_id
                         join pod_user pu on pug.user_id = pu.user_id
-                        where rights > 0
+                    where
+                        rights > 0
                         and email_address = :mail
-                        and node_id = :node""", {"mail":credentials["repoze.who.userid"], "node":node_id})
+                        and node_id = :node
+                    union
+                        select
+                            node_id
+                        from
+                            pod_nodes
+                        where
+                            node_id = :node
+                        """, {"mail":credentials["repoze.who.userid"], "node":node_id})
                 if has_right.rowcount == 0 :
                     self.unmet()
 
@@ -36,13 +47,24 @@ class can_write(Predicate):
             node_id = environ['webob.adhoc_attrs']['validation']['values']['node_id']
             if node_id!=0:
                 has_right = session.execute("""
-                        select *
-                        from pod_group_node pgn
-                        join pod_user_group pug on pug.group_id = pgn.group_id
-                        join pod_user pu on pug.user_id = pu.user_id
-                        where rights > 1
-                        and email_address = :mail
-                        and node_id = :node""", {"mail":credentials["repoze.who.userid"], "node":node_id})
+                        select
+                            node_id
+                        from
+                            pod_group_node pgn
+                            join pod_user_group pug on pug.group_id = pgn.group_id
+                            join pod_user pu on pug.user_id = pu.user_id
+                        where
+                            rights > 1
+                            and email_address = :mail
+                            and node_id = :node
+                        union
+                            select
+                                node_id
+                            from
+                                pod_nodes
+                            where
+                                node_id = :node
+                        """, {"mail":credentials["repoze.who.userid"], "node":node_id})
                 if has_right.rowcount == 0 :
                     self.unmet()