From 3a6cf48068c7057614d56092bff420901dea5a73 Mon Sep 17 00:00:00 2001 From: Roberto Rosario Date: Tue, 3 Nov 2015 16:31:03 -0400 Subject: [PATCH] Return PermissionDenied when user has no sufficient permission and accessting one document. --- mayan/apps/documents/tests/test_views.py | 6 +++--- mayan/apps/documents/views.py | 15 +++++++++------ 2 files changed, 12 insertions(+), 9 deletions(-) diff --git a/mayan/apps/documents/tests/test_views.py b/mayan/apps/documents/tests/test_views.py index 7de66b29d2..575a294967 100644 --- a/mayan/apps/documents/tests/test_views.py +++ b/mayan/apps/documents/tests/test_views.py @@ -223,7 +223,7 @@ class DocumentsViewsTestCase(GenericDocumentViewTestCase): data={'document_type': document_type.pk} ) - self.assertEqual(response.status_code, 302) + self.assertEqual(response.status_code, 403) self.assertEqual( Document.objects.get(pk=self.document.pk).document_type, @@ -258,7 +258,7 @@ class DocumentsViewsTestCase(GenericDocumentViewTestCase): Document.objects.get(pk=self.document.pk).document_type, document_type ) - +## def test_document_multiple_document_type_change_view(self): self.login( username=TEST_ADMIN_USERNAME, password=TEST_ADMIN_PASSWORD @@ -286,7 +286,7 @@ class DocumentsViewsTestCase(GenericDocumentViewTestCase): self.assertEqual( Document.objects.first().document_type, document_type ) - +## def test_document_multiple_document_type_change_user_view(self): self.login( username=TEST_USER_USERNAME, password=TEST_USER_PASSWORD diff --git a/mayan/apps/documents/views.py b/mayan/apps/documents/views.py index ff812486d4..1a46983773 100644 --- a/mayan/apps/documents/views.py +++ b/mayan/apps/documents/views.py @@ -628,12 +628,6 @@ def document_document_type_edit(request, document_id=None, document_id_list=None elif document_id_list: queryset = Document.objects.filter(pk__in=document_id_list) - if not queryset: - messages.error(request, _('Must provide at least one document.')) - return HttpResponseRedirect( - request.META.get('HTTP_REFERER', reverse(settings.LOGIN_REDIRECT_URL)) - ) - try: Permission.check_permissions( request.user, (permission_document_properties_edit,) @@ -643,6 +637,15 @@ def document_document_type_edit(request, document_id=None, document_id_list=None permission_document_properties_edit, request.user, queryset ) + if not queryset: + if document_id: + raise PermissionDenied + else: + messages.error(request, _('Must provide at least one document.')) + return HttpResponseRedirect( + request.META.get('HTTP_REFERER', reverse(settings.LOGIN_REDIRECT_URL)) + ) + previous = request.POST.get('previous', request.GET.get('previous', request.META.get('HTTP_REFERER', reverse(settings.LOGIN_REDIRECT_URL)))) next = request.POST.get('next', request.GET.get('next', post_action_redirect if post_action_redirect else request.META.get('HTTP_REFERER', reverse(settings.LOGIN_REDIRECT_URL))))