0001-forms-force-authentication-on-user-drafts-37095.patch

Nicolas Roche, 21 novembre 2019 16:18

Voir les différences: en ligne côte à côte

Subject: [PATCH] forms: force authentication on user drafts (#37095)

 tests/test_form_pages.py | 7 ++-----
 wcs/forms/root.py        | 8 +++++++-
 2 files changed, 9 insertions(+), 6 deletions(-)

         resp = resp.forms[0].submit()
         assert formdef.data_class().get(formdata_id).evolution[-1].comment == 'hello world'
         # and check we can also get back to it as anonymous
         # check we can't get back to it as anonymous
         app = get_app(pub)
         resp = app.get('/')
         resp.forms[0]['code'] = tracking_code
         resp = resp.forms[0].submit()
         assert resp.location == 'http://example.net/code/%s/load' % tracking_code
         resp = resp.follow()
         assert resp.location == 'http://example.net/test/%s' % formdata_id
         resp = resp.follow()
         resp = resp.follow()
         assert 'form_comment' in resp.text # makes sure user is treated as submitter
         assert resp.location == 'http://example.net/login/?ReturnUrl=http://example.net/test/%s' % formdata_id
         # and check a bot is not allowed to get it
         app = get_app(pub)

                 raise errors.TraversalError()
             if BotFilter.is_bot():
                 raise errors.AccessForbiddenError()
             formdata_url = formdata.get_url().rstrip('/')
             if formdata.user_id and not get_request().user:
                 # anonymous user asked to load a tracking code associated with an user,
                 # don't load, ask for authentication instead
                 return redirect('/login/?ReturnUrl=%s' % formdata_url)
             get_session().mark_anonymous_formdata(formdata)
             return redirect(formdata.get_url().rstrip('/'))
             return redirect(formdata_url)
     class TrackingCodesDirectory(Directory):
+    -

Produits Entr'ouvert » w.c.s.