Projet

Général

Profil

0001-forms-force-authentication-on-user-drafts-37095.patch

Nicolas Roche, 19 novembre 2019 18:55

Télécharger (3,38 ko)

Voir les différences: 

Subject: [PATCH] forms: force authentication on user drafts (#37095)


 tests/test_form_pages.py | 49 ++++++++++++++++++++++++++++++++++++++++
 wcs/forms/root.py        |  2 +-
 2 files changed, 50 insertions(+), 1 deletion(-)
tests/test_form_pages.py
7094 7094 

  		




  7095
  7095
  
    
    resp = resp.form.submit('button_x2').follow()

  		




  7096
  7096
  
    
    assert '<span class="status">Status2' in resp.body

  		




  
  7097
  
    

  		




  
  7098
  
    
def test_form_recall_logged_in_draft_using_tracking_code(pub):

  		




  
  7099
  
    
    user = create_user(pub)

  		




  
  7100
  
    
    formdef = create_formdef()

  		




  
  7101
  
    
    formdef.fields = [

  		




  
  7102
  
    
        fields.StringField(id='0', label='string',

  		




  
  7103
  
    
            prefill={'type': 'string',

  		




  
  7104
  
    
                     'value': 'here_1:{{form_user_email}}'}),

  		




  
  7105
  
    
        fields.CommentField(id='1', type='comment',

  		




  
  7106
  
    
            label='here_2:{{form_user_email}}'),

  		




  
  7107
  
    
    ]

  		




  
  7108
  
    
    formdef.enable_tracking_codes = True

  		




  
  7109
  
    
    formdef.store()

  		




  
  7110
  
    

  		




  
  7111
  
    
    resp = login(get_app(pub), username='foo', password='foo').get('/test/')

  		




  
  7112
  
    
    formdef.data_class().wipe()

  		




  
  7113
  
    
    assert '<h3>Tracking code</h3>' in resp.body

  		




  
  7114
  
    
    tracking_code = get_displayed_tracking_code(resp)

  		




  
  7115
  
    
    assert tracking_code is not None

  		




  
  7116
  
    
    assert 'here_1:foo@localhost' in resp.body

  		




  
  7117
  
    
    assert 'here_2:foo@localhost' in resp.body

  		




  
  7118
  
    
    resp = resp.forms[0].submit('submit')

  		




  
  7119
  
    
    assert formdef.data_class().count() == 1

  		




  
  7120
  
    
    formdata_id = formdef.data_class().select()[0].id

  		




  
  7121
  
    

  		




  
  7122
  
    
    # anonymous user must authenticate to restore user related drafts

  		




  
  7123
  
    
    pub.session_manager.session_class.wipe()

  		




  
  7124
  
    
    resp = get_app(pub).get('/')

  		




  
  7125
  
    
    resp.forms[0]['code'] = tracking_code

  		




  
  7126
  
    
    resp = resp.forms[0].submit()

  		




  
  7127
  
    
    assert resp.location == 'http://example.net/code/%s/load' % tracking_code

  		




  
  7128
  
    
    resp = resp.follow()

  		




  
  7129
  
    
    assert resp.location == 'http://example.net/test/%s' % formdata_id

  		




  
  7130
  
    
    resp = resp.follow()

  		




  
  7131
  
    
    assert resp.location.startswith('http://example.net/login/?next=')

  		




  
  7132
  
    

  		




  
  7133
  
    
    # authenticated user retrieve form_user variables valuated

  		




  
  7134
  
    
    resp = login(get_app(pub), username='foo', password='foo').get('/')

  		




  
  7135
  
    
    resp.forms[0]['code'] = tracking_code

  		




  
  7136
  
    
    resp = resp.forms[0].submit()

  		




  
  7137
  
    
    assert resp.location == 'http://example.net/code/%s/load' % tracking_code

  		




  
  7138
  
    
    resp = resp.follow()

  		




  
  7139
  
    
    assert resp.location == 'http://example.net/test/%s' % formdata_id

  		




  
  7140
  
    
    resp = resp.follow()

  		




  
  7141
  
    
    assert resp.location.startswith('http://example.net/test/?mt=')

  		




  
  7142
  
    
    resp = resp.follow()

  		




  
  7143
  
    
    resp = resp.forms[1].submit('previous')

  		




  
  7144
  
    
    assert 'here_1:foo@localhost' in resp.body

  		




  
  7145
  
    
    assert 'here_2:foo@localhost' in resp.body

  		












  

    
      wcs/forms/root.py
    
  





  1289
  1289
  
    
        # restore draft

  		




  1290
  1290
  
    
        session = get_session()

  		




  1291
  1291
  
    
        if not (get_request().is_in_backoffice() and filled.backoffice_submission):

  		




  1292
  
  
    
            if session.is_anonymous_submitter(filled):

  		




  
  1292
  
    
            if not filled.user_id and session.is_anonymous_submitter(filled):

  		




  1293
  1293
  
    
                pass

  		




  1294
  1294
  
    
            elif session.user:

  		




  1295
  1295
  
    
                if str(session.user) != str(filled.user_id):

  		




  1296
  
  
    
-