matthias/mayan-edms
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Return PermissionDenied when user has no sufficient permission and accessting one document.

Browse Source
This commit is contained in:
Roberto Rosario
2015-11-03 16:31:03 -04:00
parent 8a50721117
commit 3a6cf48068
2 changed files with 12 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
mayan/apps/documents/tests/test_views.py
View File

@@ -223,7 +223,7 @@ class DocumentsViewsTestCase(GenericDocumentViewTestCase):
data={'document_type': document_type.pk}
)
self.assertEqual(response.status_code, 302)
self.assertEqual(response.status_code, 403)
self.assertEqual(
Document.objects.get(pk=self.document.pk).document_type,
@@ -258,7 +258,7 @@ class DocumentsViewsTestCase(GenericDocumentViewTestCase):
Document.objects.get(pk=self.document.pk).document_type,
document_type
)
##
def test_document_multiple_document_type_change_view(self):
self.login(
username=TEST_ADMIN_USERNAME, password=TEST_ADMIN_PASSWORD
@@ -286,7 +286,7 @@ class DocumentsViewsTestCase(GenericDocumentViewTestCase):
self.assertEqual(
Document.objects.first().document_type, document_type
)
##
def test_document_multiple_document_type_change_user_view(self):
self.login(
username=TEST_USER_USERNAME, password=TEST_USER_PASSWORD

15
mayan/apps/documents/views.py
View File

@@ -628,12 +628,6 @@ def document_document_type_edit(request, document_id=None, document_id_list=None
elif document_id_list:
queryset = Document.objects.filter(pk__in=document_id_list)
if not queryset:
messages.error(request, _('Must provide at least one document.'))
return HttpResponseRedirect(
request.META.get('HTTP_REFERER', reverse(settings.LOGIN_REDIRECT_URL))
)
try:
Permission.check_permissions(
request.user, (permission_document_properties_edit,)
@@ -643,6 +637,15 @@ def document_document_type_edit(request, document_id=None, document_id_list=None
permission_document_properties_edit, request.user, queryset
)
if not queryset:
if document_id:
raise PermissionDenied
else:
messages.error(request, _('Must provide at least one document.'))
return HttpResponseRedirect(
request.META.get('HTTP_REFERER', reverse(settings.LOGIN_REDIRECT_URL))
)
previous = request.POST.get('previous', request.GET.get('previous', request.META.get('HTTP_REFERER', reverse(settings.LOGIN_REDIRECT_URL))))
next = request.POST.get('next', request.GET.get('next', post_action_redirect if post_action_redirect else request.META.get('HTTP_REFERER', reverse(settings.LOGIN_REDIRECT_URL))))