q = ("select distinct path from xfeatures inner join "
" (select distinct feature_id, key from xfeaturevals inner join "
" (select owner || ':' || name as value from groups "
- " where member = ? union select ?) "
+ " where member = ? union select ? union select '*') "
" using (value)) "
"using (feature_id)")
p = (member, member)
raise NotAllowedError
def _allowed_paths(self, user, prefix=None):
- sql = '''select distinct name from permissions where (user = ?
- or user in (select account || ':' || gname from groups where user = ?))'''
+ sql = '''select distinct name from permissions
+ where (user = '*' or
+ user = ? or
+ user in (select account || ':' || gname from groups where user = ?))'''
param = (user, user)
if prefix:
sql += ' and name like ?'