Changeset - 1522c37cbc62
[Not reviewed]
default
0 4 0
Mads Kiilerich - 9 years ago 2016-08-04 14:23:36
madski@unity3d.com
routing: use POST to 'update_users_group' instead of PUT
4 files changed with 5 insertions and 6 deletions:
0 comments (0 inline, 0 general)
kallithea/config/routing.py
Show inline comments
 
@@ -224,7 +224,7 @@ def make_map(config):
 
        m.connect("new_users_group", "/user_groups/new",
 
                  action="new", conditions=dict(method=["GET"]))
 
        m.connect("update_users_group", "/user_groups/{id}",
 
                  action="update", conditions=dict(method=["PUT"]))
 
                  action="update", conditions=dict(method=["POST"]))
 
        m.connect("delete_users_group", "/user_groups/{id}/delete",
 
                  action="delete", conditions=dict(method=["POST"]))
 
        m.connect("edit_users_group", "/user_groups/{id}/edit",
kallithea/controllers/admin/user_groups.py
Show inline comments
 
@@ -194,7 +194,6 @@ class UserGroupsController(BaseControlle
 
                                                      'hg.create.repository'),
 
                'fork_repo_perm': ug_model.has_perm(id,
 
                                                    'hg.fork.repository'),
 
                '_method': 'put'
 
            })
 

	
 
            return htmlfill.render(
kallithea/templates/admin/user_groups/user_group_edit_settings.html
Show inline comments
 
${h.form(url('users_group', id=c.user_group.users_group_id),method='put', id='edit_users_group')}
 
${h.form(url('update_users_group', id=c.user_group.users_group_id), id='edit_users_group')}
 
    <div class="form">
 
        <!-- fields -->
 
            <div class="fields">
kallithea/tests/functional/test_admin_user_groups.py
Show inline comments
 
@@ -32,11 +32,11 @@ class TestAdminUsersGroupsController(Tes
 
        response = self.app.get(url('new_users_group'))
 

	
 
    def test_update(self):
 
        response = self.app.put(url('users_group', id=1), status=403)
 
        response = self.app.post(url('update_users_group', id=1), status=403)
 

	
 
    def test_update_browser_fakeout(self):
 
        response = self.app.post(url('users_group', id=1),
 
                                 params=dict(_method='put', _authentication_token=self.authentication_token()))
 
        response = self.app.post(url('update_users_group', id=1),
 
                                 params=dict(_authentication_token=self.authentication_token()))
 

	
 
    def test_delete(self):
 
        self.log_user()
0 comments (0 inline, 0 general)