Projet

Général

Profil

0001-manager-let-user-with-view-permission-access-the-eve.patch

Frédéric Péters, 03 mars 2018 11:13

Télécharger (4,1 ko)

Voir les différences: 

Subject: [PATCH] manager: let user with view permission access the events
 agenda page (#22245)


 chrono/manager/views.py | 13 +++++++++++++
 tests/test_manager.py   | 28 ++++++++++++++++++++++++----
 2 files changed, 37 insertions(+), 4 deletions(-)
chrono/manager/views.py
358 358 
    template_name = 'chrono/manager_agenda_settings.html'
359 359 
    model = Agenda
360 360 

  		




  
  361
  
    
    def dispatch(self, request, *args, **kwargs):

  		




  
  362
  
    
        try:

  		




  
  363
  
    
            self.agenda = Agenda.objects.get(id=kwargs.get('pk'))

  		




  
  364
  
    
        except Agenda.DoesNotExist:

  		




  
  365
  
    
            raise Http404()

  		




  
  366
  
    
        if not self.agenda.can_be_managed(request.user):

  		




  
  367
  
    
            # "events" agendas settings page can be access by user with the

  		




  
  368
  
    
            # view permission as there are no other "view" page for this type

  		




  
  369
  
    
            # of agenda.

  		




  
  370
  
    
            if self.agenda.kind != 'events' or not self.agenda.can_be_viewed(request.user):

  		




  
  371
  
    
                raise PermissionDenied()

  		




  
  372
  
    
        return super(DetailView, self).dispatch(request, *args, **kwargs)

  		




  
  373
  
    

  		




  361
  374
  
    
    def get_context_data(self, **kwargs):

  		




  362
  375
  
    
        context = super(AgendaSettings, self).get_context_data(**kwargs)

  		




  363
  376
  
    
        context['user_can_manage'] = self.get_object().can_be_managed(self.request.user)

  		












  

    
      tests/test_manager.py
    
  





  119
  119
  
    
    agenda.view_role = manager_user.groups.all()[0]

  		




  120
  120
  
    
    agenda.save()

  		




  121
  121
  
    

  		




  122
  
  
    
    agenda = Agenda(label=u'Bar Foo')

  		




  123
  
  
    
    agenda.save()

  		




  
  122
  
    
    agenda2 = Agenda(label=u'Bar Foo')

  		




  
  123
  
    
    agenda2.save()

  		




  124
  124
  
    

  		




  125
  125
  
    
    app = login(app, username='manager', password='manager')

  		




  126
  126
  
    
    resp = app.get('/manage/', status=200)

  		




  ......




  128
  128
  
    
    assert 'Bar Foo' not in resp.body

  		




  129
  129
  
    
    assert 'New' not in resp.body

  		




  130
  130
  
    

  		




  131
  
  
    
    app.get('/manage/agendas/%s/' % agenda.id, status=403)

  		




  
  131
  
    
    # check user doesn't have access

  		




  
  132
  
    
    app.get('/manage/agendas/%s/' % agenda2.id, status=403)

  		




  
  133
  
    

  		




  
  134
  
    
    # check view gives access to the settings page for "events" agenda

  		




  
  135
  
    
    resp = app.get('/manage/agendas/%s/settings' % agenda.id, status=200)

  		




  
  136
  
    
    # but there's no links to actions

  		




  
  137
  
    
    assert not '>New Event<' in resp.body

  		




  
  138
  
    
    assert not '>Options<' in resp.body

  		




  
  139
  
    
    app.get('/manage/agendas/%s/add-event' % agenda.id, status=403)

  		




  
  140
  
    
    app.get('/manage/agendas/%s/edit' % agenda.id, status=403)

  		




  
  141
  
    

  		




  
  142
  
    
    # check it doesn't give access for "meetings" agenda

  		




  
  143
  
    
    agenda.kind = 'meetings'

  		




  
  144
  
    
    agenda.save()

  		




  
  145
  
    
    resp = app.get('/manage/agendas/%s/settings' % agenda.id, status=403)

  		




  132
  146
  
    

  		




  133
  147
  
    
def test_add_agenda(app, admin_user):

  		




  134
  148
  
    
    app = login(app)

  		




  ......




  176
  190
  
    
    resp = app.get('/manage/', status=200)

  		




  177
  191
  
    
    resp = resp.click('Foo bar')

  		




  178
  192
  
    
    assert not 'Settings' in resp.body

  		




  
  193
  
    
    resp = app.get('/manage/agendas/%s/settings' % agenda.id, status=200)  # ok for "events" agendas

  		




  
  194
  
    
    resp = app.get('/manage/agendas/%s/edit' % agenda.id, status=403)

  		




  
  195
  
    
    agenda.kind = 'meetings'

  		




  
  196
  
    
    agenda.save()

  		




  179
  197
  
    
    resp = app.get('/manage/agendas/%s/settings' % agenda.id, status=403)

  		




  180
  198
  
    
    resp = app.get('/manage/agendas/%s/edit' % agenda.id, status=403)

  		




  181
  199
  
    

  		




  
  200
  
    
    agenda.kind = 'events'

  		




  
  201
  
    
    agenda.save()

  		




  
  202
  
    

  		




  182
  203
  
    
    agenda.edit_role = manager_user.groups.all()[0]

  		




  183
  204
  
    
    agenda.save()

  		




  184
  205
  
    

  		




  ......




  282
  303
  
    
    agenda.save()

  		




  283
  304
  
    
    app = login(app, username='manager', password='manager')

  		




  284
  305
  
    
    resp = app.get('/manage/agendas/%s/' % agenda.id, status=302)

  		




  285
  
  
    
    app.get('/manage/agendas/%s/settings' % agenda.id, status=403)

  		




  286
  306
  
    
    app.get('/manage/agendas/%s/add-event' % agenda.id, status=403)

  		




  287
  307
  
    

  		




  288
  308
  
    
    agenda.edit_role = manager_user.groups.all()[0]

  		




  289
  
  
    
-