Potree scene edit permission checks

app/api/potree.py

@@ -16,8 +16,10 @@ class Scene(TaskNestedView):
         """
         Store potree scene information (except camera view)
         """
-        get_and_check_project(request, project_pk, perms=("change_project", ))
         task = self.get_and_check_task(request, pk)
+        print(task, task.public, task.public_edit)
+        if (not task.public) or (task.public and not task.public_edit):
+            get_and_check_project(request, project_pk, perms=("change_project", ))
         scene = request.data
 
         # Quick type check
@@ -36,8 +38,9 @@ class CameraView(TaskNestedView):
         """
         Store camera view information
         """
-        get_and_check_project(request, project_pk, perms=("change_project", ))
         task = self.get_and_check_task(request, pk)
+        if (not task.public) or (task.public and not task.public_edit):
+            get_and_check_project(request, project_pk, perms=("change_project", ))
 
         view = request.data
         if not view:

app/models/task.py

@@ -1027,6 +1027,7 @@ class Task(models.Model):
             'project': self.project.id,
             'available_assets': self.available_assets,
             'public': self.public,
+            'public_edit': self.public_edit,
             'epsg': self.epsg
         }
 

app/static/app/js/components/SharePopup.jsx

@@ -121,7 +121,6 @@ class SharePopup extends React.Component{
     const shareLink = Utils.absoluteUrl(this.getRelShareLink());
     const iframeUrl = Utils.absoluteUrl(`public/task/${this.state.task.id}/iframe/${this.props.linksTarget}/${Utils.toSearchQuery(this.props.queryParams)}`);
     const iframeCode = `<iframe scrolling="no" title="WebODM" width="61.8033%" height="360" frameBorder="0" src="${iframeUrl}"></iframe>`;
-    console.log(this.state.task);
 
     return (<div onMouseDown={e => { e.stopPropagation(); }} className={"sharePopup " + this.props.placement}>
       <div className={"sharePopupContainer popover in " + this.props.placement}>

app/tests/test_api_task.py

@@ -766,6 +766,19 @@ class TestApiTask(BootTransactionTestCase):
             res = other_client.post("/api/projects/{}/tasks/{}/3d/scene".format(project.id, task.id), json.dumps({ "type": "Potree", "modified": True }), content_type="application/json")
             self.assertEqual(res.status_code, status.HTTP_404_NOT_FOUND)
 
+            # Original owner enables edits
+            res = client.patch("/api/projects/{}/tasks/{}/".format(project.id, task.id), {
+                'public': True,
+                'public_edit': True
+            })
+            self.assertTrue(res.status_code == status.HTTP_200_OK)
+            
+            # He can now save scene / change camera view
+            res = other_client.post("/api/projects/{}/tasks/{}/3d/cameraview".format(project.id, task.id), json.dumps({ "position": [0,0,0], "target": [0,0,0] }), content_type="application/json")
+            self.assertEqual(res.status_code, status.HTTP_200_OK)
+            res = other_client.post("/api/projects/{}/tasks/{}/3d/scene".format(project.id, task.id), json.dumps({ "type": "Potree", "modified": True }), content_type="application/json")
+            self.assertEqual(res.status_code, status.HTTP_200_OK)
+
             # User logs out
             other_client.logout()