0002-backoffice-don-t-include-anonymised-formdata-in-list.patch

Frédéric Péters, 25 novembre 2019 09:17

Voir les différences: en ligne côte à côte

Subject: [PATCH 2/2] backoffice: don't include anonymised formdata in listings
 (#33707)

 tests/test_backoffice_pages.py | 39 ++++++++++++++++++++++++++++++++++
 wcs/backoffice/management.py   |  1 +
 wcs/forms/backoffice.py        | 19 ++++++++++++-----
 wcs/sql.py                     | 30 ++++++++++++++++++++------
 4 files changed, 78 insertions(+), 11 deletions(-)

         ids = [x.strip('/') for x in re.findall(r'data-link="(.*?)"', resp.text)]
         assert ids == list(reversed(last_update_time_order))
     def test_backoffice_listing_anonymised(pub):
         if not pub.is_using_postgresql():
             pytest.skip('this requires SQL')
             return
         create_superuser(pub)
         create_environment(pub)
         app = login(get_app(pub))
         resp = app.get('/backoffice/management/form-title/?limit=500')
         assert resp.text.count('data-link') == 17
         formdef = FormDef.get_by_urlname('form-title')
         for i, formdata in enumerate(formdef.data_class().select(order_by='id')):
             if i % 2:
                 formdata.anonymise()
         resp = app.get('/backoffice/management/form-title/?limit=500')
         assert resp.text.count('data-link') == 9
     def test_backoffice_legacy_urls(pub):
         create_superuser(pub)
         create_environment(pub)
-...
         resp = resp.forms['listing-settings'].submit()
         assert resp.text[resp.text.index('<tbody'):].count('<tr') == 37
     def test_global_listing_anonymised(pub):
         if not pub.is_using_postgresql():
             pytest.skip('this requires SQL')
             return
         create_user(pub)
         create_environment(pub)
         app = login(get_app(pub))
         resp = app.get('/backoffice/management/listing?limit=500&status=all')
         assert resp.text[resp.text.index('<tbody'):].count('<tr') == 70
         formdef = FormDef.get_by_urlname('other-form')
         for formdata in formdef.data_class().select():
             formdata.anonymise()
         resp = app.get('/backoffice/management/listing?limit=500&status=all')
         assert resp.text[resp.text.index('<tbody'):].count('<tr') == 50
         resp = app.get('/backoffice/management/listing?limit=500&status=open')
         assert resp.text[resp.text.index('<tbody'):].count('<tr') == 17
     def test_global_listing_geojson(pub):
         if not pub.is_using_postgresql():
             pytest.skip('this requires SQL')

wcs/backoffice/management.py
840	840	get_publisher().get_site_option('default-sort-order') or '-receipt_time')
841	841
842	842	criterias = self.get_global_listing_criterias()
	843	criterias.append(Null('anonymised')) # exclude anonymised forms
843	844	total_count = sql.AnyFormData.count(criterias)
844	845	if offset > total_count:
845	846	get_request().form['offset'] = '0'

     from ..qommon import misc
     from ..qommon.form import *
     from ..qommon.backoffice.listing import pagination_links
     from wcs.qommon.storage import Null
     from wcs.roles import logged_users_role
     class FormDefUI(object):
-...
                         include_checkboxes=False):
             partial_display = False
             using_postgresql = get_publisher().is_using_postgresql()
             if not items:
                 if offset and not limit:
                     limit = int(get_publisher().get_site_option('default-page-size') or 20)
                 if not criterias:
                     criterias = []
                 if using_postgresql:
                     criterias.append(Null('anonymised'))
                 items, total_count = self.get_listing_items(
                                 selected_filter, offset, limit, query, order_by,
                                 criterias=criterias)
-...
                 r += htmltext('<col />')
             r += htmltext('</colgroup>')
             using_postgresql = get_publisher().is_using_postgresql()
             r += htmltext('<thead><tr>')
             if self.formdef.workflow.criticality_levels and using_postgresql:
                 r += htmltext('<th class="criticality-level-cell" data-field-sort-key="criticality_level"><span></span></th>')
-...
         def get_listing_item_ids(self, selected_filter='all', query=None, order_by=None, user=None, criterias=None, anonymise=False):
             formdata_class = self.formdef.data_class()
             clause_kwargs = {}
             if get_publisher().is_using_postgresql():
                 # pass criterias to all queries
                 clause_kwargs = {'clause': criterias}
             if selected_filter == 'all':
                 item_ids = formdata_class.keys()
                 item_ids = formdata_class.keys(**clause_kwargs)
                 drafts = {x: True for x in formdata_class.get_ids_with_indexed_value('status', 'draft')}
                 item_ids = [x for x in item_ids if x not in drafts]
             elif selected_filter == 'waiting':
-...
                 item_ids = []
                 for status_id in applied_filters:
                     item_ids.extend(formdata_class.get_ids_with_indexed_value(
                                             str('status'), status_id))
                         'status', status_id, **clause_kwargs))
             if query:
                 query_ids = formdata_class.get_ids_from_query(query)
-...
                 # get_sorted_ids is only implemented in the SQL backend
                 order_by = None
             if order_by and not anonymise:
                 ordered_ids = formdata_class.get_sorted_ids(order_by)
                 ordered_ids = formdata_class.get_sorted_ids(order_by, clause=criterias)
                 item_ids_dict = {x: True for x in item_ids}
                 item_ids = [x for x in ordered_ids if x in item_ids_dict]
             else:

         @classmethod
         @guard_postgres
         def keys(cls):
         def keys(cls, clause=None):
             conn, cur = get_connection_and_cursor()
             where_clauses, parameters, func_clause = parse_clause(clause)
             assert not func_clause
             sql_statement = 'SELECT id FROM %s' % cls._table_name
             cur.execute(sql_statement)
             if where_clauses:
                 sql_statement += ' WHERE ' + ' AND '.join(where_clauses)
             cur.execute(sql_statement, parameters)
             ids = [x[0] for x in cur.fetchall()]
             conn.commit()
             cur.close()
-...
         @classmethod
         @guard_postgres
         def get_sorted_ids(cls, order_by):
         def get_sorted_ids(cls, order_by, clause=None):
             conn, cur = get_connection_and_cursor()
             sql_statement = 'SELECT id FROM %s' % cls._table_name
             where_clauses, parameters, func_clause = parse_clause(clause)
             assert not func_clause
             if where_clauses:
                 sql_statement += ' WHERE ' + ' AND '.join(where_clauses)
             if order_by.startswith('-'):
                 order_by = order_by[1:]
                 sql_statement += ' ORDER BY %s DESC' % order_by.replace('-', '_')
             else:
                 sql_statement += ' ORDER BY %s' % order_by.replace('-', '_')
             cur.execute(sql_statement)
             cur.execute(sql_statement, parameters)
             ids = [x[0] for x in cur.fetchall()]
             conn.commit()
             cur.close()
-...
         @classmethod
         @guard_postgres
         def get_ids_with_indexed_value(cls, index, value, auto_fallback=True):
         def get_ids_with_indexed_value(cls, index, value, auto_fallback=True, clause=None):
             conn, cur = get_connection_and_cursor()
             where_clauses, parameters, func_clause = parse_clause(clause)
             assert not func_clause
             if type(value) is int:
                 value = str(value)
-...
                 sql_statement = '''SELECT id FROM %s WHERE %s = %%(value)s''' % (
                                 cls._table_name,
                                 index)
             cur.execute(sql_statement, {'value': value})
             if where_clauses:
                 sql_statement += ' AND ' + ' AND '.join(where_clauses)
             else:
                 parameters = {}
             parameters.update({'value': value})
             cur.execute(sql_statement, parameters)
             all_ids = [x[0] for x in cur.fetchall()]
             cur.close()
             return all_ids
+    -

Projet

Général

Profil

Produits Entr'ouvert » w.c.s.

0002-backoffice-don-t-include-anonymised-formdata-in-list.patch