0001-api-do-not-advertise-all-forms-for-backoffice-submis.patch

Frédéric Péters, 16 octobre 2019 16:20

Voir les différences: en ligne côte à côte

Subject: [PATCH] api: do not advertise all forms for backoffice submission to
 admins (#36988)

 tests/test_api.py |  4 ++--
 wcs/api.py        | 13 +++++++------
 2 files changed, 9 insertions(+), 8 deletions(-)

         assert resp.json['err'] == 0
         assert len(resp.json['data']) == 0
         # ... unless user is admin
         # even if user is admin
         local_user.is_admin = True
         local_user.store()
         resp = get_app(pub).get(sign_uri('/api/formdefs/?backoffice-submission=on&NameID=%s' %
                                          local_user.name_identifiers[0]))
         assert resp.json['err'] == 0
         assert len(resp.json['data']) == 1
         assert len(resp.json['data']) == 0
         local_user.is_admin = False
         local_user.store()

                 elif backoffice_submission:
                     if not formdef.backoffice_submission_roles:
                         continue
                     if not list_all_forms:
                         for role in user.get_roles():
                             if role in formdef.backoffice_submission_roles:
                                 break
                         else:
                             continue
                     for role in user.get_roles():
                         if role in formdef.backoffice_submission_roles:
                             break
                     else:
                         continue
                 elif formdef.roles and user is None and list_all_forms:
                     # anonymous API call, mark authentication as required
                     authentication_required = True
-...
                 user = False
             list_all_forms = (user and user.is_admin) or (is_url_signed() and user is None)
             backoffice_submission = get_request().form.get('backoffice-submission') == 'on'
             if backoffice_submission:
                 list_all_forms = True
             list_forms = self.get_list_forms(user, list_all_forms,
                                              backoffice_submission=backoffice_submission)
+    -

Produits Entr'ouvert » w.c.s.