Fix #961 -- Move view detail permissions into project user policy #1071
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
linzjax
approved these changes
Jan 23, 2017
seav
suggested changes
Jan 24, 2017
| @@ -4,5 +4,35 @@ | |||
| // additional permissions over those given to all users. This may | |||
| // change in the future. In particular, project users may be | |||
| // permitted access to projects that are normally private. | |||
There was a problem hiding this comment.
This comment is no longer correct ("...no additional permissions...").
| @@ -84,8 +84,27 @@ def test_get_from_non_existent_project(self): | |||
| def test_get_with_unauthorized_user(self): | |||
| user = UserFactory.create() | |||
| response = self.request(user=user) | |||
| assert response.status_code == 302 | |||
There was a problem hiding this comment.
Please add another assertion for the redirect URL.
There was a problem hiding this comment.
This isn't necessary.
The redirect URL is based on the referrer and it is defined in core.mixins.PermissionRequiredMixin.handle_no_permission, which has appropriate tests.
oliverroick
force-pushed
the
bugfix/#961
branch
from
b264c86 to
3a83fb0
Compare
|
|
seav
approved these changes
Jan 25, 2017
oliverroick
force-pushed
the
bugfix/#961
branch
2 times, most recently
from
6b5d7b2 to
9ca5e01
Compare
|
The updated changes are OK. |
oliverroick
force-pushed
the
bugfix/#961
branch
from
9ca5e01 to
5be9fcc
Compare
oliverroick
force-pushed
the
bugfix/#961
branch
from
5be9fcc to
878b32e
Compare
20 tasks
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Proposed changes in this pull request
viewpermissions for all entities into the project user policy description. Organisation members will not be able to view details for locations, relationships, parties and resources for any of the organisation's projects; unless they are a member of the project.PartiesListto make it consistent with locations listing: All parties are listed, not taking into account whether the user can view details or not.When should this PR be merged
Anytime
Risks
None
Follow up actions
Permissions policies need to be reloaded when deploying (/cc @amplifi)
Checklist (for reviewing)
General
migrationlabel if a new migration is added.Is the risk level assessment sufficient? The risks section should contain all risks that might be introduced with the PR and which actions we need to take to mitigate these risks. Possible risks are database migrations, new libraries that need to be installed or changes to deployment scripts.
Functionality
Code
Tests
Documentation