0001-api-limit-forms-sent-to-admin-when-backoffice-submis.patch

Frédéric Péters, 10 août 2018 11:58

Voir les différences: en ligne côte à côte

Subject: [PATCH] api: limit forms sent to admin when backoffice submission is
 requested (#25626)

 tests/test_api.py | 15 +++++++++++++++
 wcs/api.py        | 13 +++++++------
 2 files changed, 22 insertions(+), 6 deletions(-)

         formdef.fields = []
         formdef.store()
         formdef2 = FormDef()
         formdef2.name = 'ignore me'
         formdef2.fields = []
         formdef2.store()
         resp = get_app(pub).get('/api/formdefs/?backoffice-submission=on')
         assert resp.json['err'] == 0
         assert len(resp.json['data']) == 0
-...
         assert resp.json['err'] == 0
         assert len(resp.json['data']) == 0
         # ... unless user is admin
         local_user.is_admin = True
         local_user.store()
         resp = get_app(pub).get(sign_uri('/api/formdefs/?backoffice-submission=on&NameID=%s' %
                                          local_user.name_identifiers[0]))
         assert resp.json['err'] == 0
         assert len(resp.json['data']) == 1
         local_user.is_admin = False
         local_user.store()
         # ... unless user has correct roles
         local_user.roles = [role.id]
         local_user.store()

                             if not formdef.always_advertise:
                                 continue
                             authentication_required = True
                 elif backoffice_submission and not list_all_forms:
                 elif backoffice_submission:
                     if not formdef.backoffice_submission_roles:
                         continue
                     for role in user.roles or []:
                         if role in formdef.backoffice_submission_roles:
                             break
                     else:
                         continue
                     if not list_all_forms:
                         for role in user.roles or []:
                             if role in formdef.backoffice_submission_roles:
                                 break
                         else:
                             continue
                 elif formdef.roles and user is None and list_all_forms:
                     # anonymous API call, mark authentication as required
                     authentication_required = True
+    -

Produits Entr'ouvert » w.c.s.