Projet

Général

Profil

0001-forms-allow-loggedin-user-to-use-an-anonymous-tracki.patch

Frédéric Péters, 19 décembre 2018 16:17

Télécharger (3,87 ko)

Voir les différences: 

Subject: [PATCH] forms: allow loggedin user to use an anonymous tracking code
 (#29218)


 tests/test_form_pages.py | 35 ++++++++++++++++++++++++++++++++++-
 wcs/forms/root.py        | 10 +++++-----
 2 files changed, 39 insertions(+), 6 deletions(-)
tests/test_form_pages.py
1295 1295 
    resp = resp.follow()
1296 1296 
    assert resp.location.startswith('http://example.net/test/?mt=')
1297 1297 
    resp = resp.follow()
1298 

  		




  
  1299
  
    
    # check anonymous user can't get to it from the URL

  		




  
  1300
  
    
    pub.session_manager.session_class.wipe()

  		




  
  1301
  
    
    resp = get_app(pub).get('http://example.net/test/%s' % formdata_id)

  		




  
  1302
  
    
    assert resp.location.startswith('http://example.net/login')

  		




  
  1303
  
    

  		




  
  1304
  
    
    # or logged users that didn't enter the code:

  		




  
  1305
  
    
    user = create_user(pub)

  		




  
  1306
  
    
    login(get_app(pub), username='foo', password='foo').get(

  		




  
  1307
  
    
            'http://example.net/test/%s' % formdata_id, status=403)

  		




  
  1308
  
    

  		




  
  1309
  
    
    # check we can also get to it as a logged user

  		




  
  1310
  
    
    pub.session_manager.session_class.wipe()

  		




  
  1311
  
    
    resp = login(get_app(pub), username='foo', password='foo').get('/')

  		




  
  1312
  
    
    resp.forms[0]['code'] = tracking_code.lower()

  		




  
  1313
  
    
    resp = resp.forms[0].submit()

  		




  
  1314
  
    
    assert resp.location == 'http://example.net/code/%s/load' % tracking_code.lower()

  		




  
  1315
  
    
    resp = resp.follow()

  		




  
  1316
  
    
    assert resp.location == 'http://example.net/test/%s' % formdata_id

  		




  
  1317
  
    
    resp = resp.follow()

  		




  
  1318
  
    

  		




  
  1319
  
    
    # go back as anonymous

  		




  
  1320
  
    
    pub.session_manager.session_class.wipe()

  		




  
  1321
  
    
    resp = get_app(pub).get('/')

  		




  
  1322
  
    
    resp.forms[0]['code'] = tracking_code

  		




  
  1323
  
    
    resp = resp.forms[0].submit()

  		




  
  1324
  
    
    assert resp.location == 'http://example.net/code/%s/load' % tracking_code

  		




  
  1325
  
    
    resp = resp.follow()

  		




  
  1326
  
    
    assert resp.location == 'http://example.net/test/%s' % formdata_id

  		




  
  1327
  
    
    resp = resp.follow()

  		




  
  1328
  
    
    assert resp.location.startswith('http://example.net/test/?mt=')

  		




  
  1329
  
    
    resp = resp.follow()

  		




  1298
  1330
  
    
    resp = resp.forms[1].submit('previous')

  		




  1299
  1331
  
    
    assert resp.forms[1]['f0'].value == 'foobar'

  		




  1300
  1332
  
    

  		




  ......




  1326
  1358
  
    
    assert formdef.data_class().get(formdata_id).evolution[-1].comment == 'hello world'

  		




  1327
  1359
  
    

  		




  1328
  1360
  
    
    # check we can also use it with lowercase letters.

  		




  1329
  
  
    
    # check we can still go back to it

  		




  1330
  1361
  
    
    app = get_app(pub)

  		




  1331
  1362
  
    
    resp = app.get('/')

  		




  1332
  1363
  
    
    resp.forms[0]['code'] = tracking_code.lower()

  		




  ......




  1334
  1365
  
    
    assert resp.location == 'http://example.net/code/%s/load' % tracking_code.lower()

  		




  1335
  1366
  
    
    resp = resp.follow()

  		




  1336
  1367
  
    
    assert resp.location == 'http://example.net/test/%s' % formdata_id

  		




  
  1368
  
    
    resp = resp.follow()

  		




  
  1369
  
    

  		




  1337
  1370
  
    

  		




  1338
  1371
  
    
def test_form_tracking_code_as_user(pub):

  		




  1339
  1372
  
    
    user = create_user(pub)

  		












  

    
      wcs/forms/root.py
    
  





  1266
  1266
  
    

  		




  1267
  1267
  
    
        session = get_session()

  		




  1268
  1268
  
    
        if not (get_request().is_in_backoffice() and filled.backoffice_submission):

  		




  1269
  
  
    
            if session.user:

  		




  1270
  
  
    
                if str(session.user) != str(filled.user_id):

  		




  1271
  
  
    
                    raise errors.AccessForbiddenError()

  		




  
  1269
  
    
            if session.is_anonymous_submitter(filled):

  		




  
  1270
  
    
                pass

  		




  
  1271
  
    
            elif session.user and str(session.user) != str(filled.user_id):

  		




  
  1272
  
    
                raise errors.AccessUnauthorizedError()

  		




  1272
  1273
  
    
            else:

  		




  1273
  
  
    
                if not session.is_anonymous_submitter(filled):

  		




  1274
  
  
    
                    raise errors.AccessUnauthorizedError()

  		




  
  1274
  
    
                raise errors.AccessUnauthorizedError()

  		




  1275
  1275
  
    

  		




  1276
  1276
  
    
        if get_request().get_query() == 'remove-draft':

  		




  1277
  1277
  
    
            filled.remove_self()

  		




  1278
  
  
    
-