Changeset - 1522c37cbc62
Parent rev.
Child rev.
[Not reviewed]
default
0 4 0
Mads Kiilerich - 9 years ago 2016-08-04 14:23:36
madski@unity3d.com
routing: use POST to 'update_users_group' instead of PUT
4 files changed with 5 insertions and 6 deletions:
kallithea/config/routing.py
1
1
kallithea/controllers/admin/user_groups.py
1
kallithea/templates/admin/user_groups/user_group_edit_settings.html
1
1
kallithea/tests/functional/test_admin_user_groups.py
3
3
0 comments (0 inline, 0 general)
kallithea/config/routing.py
➞
Show inline comments
 
@@ -179,97 +179,97 @@ def make_map(config):
 
                  action="new", conditions=dict(method=["GET"]))
 
        m.connect("update_user", "/users/{id}",
 
                  action="update", conditions=dict(method=["POST"]))
 
        m.connect("delete_user", "/users/{id}/delete",
 
                  action="delete", conditions=dict(method=["POST"]))
 
        m.connect("edit_user", "/users/{id}/edit",
 
                  action="edit", conditions=dict(method=["GET"]))
 

			




	
	
	
		
 
        #EXTRAS USER ROUTES

			




	
	
	
		
 
        m.connect("edit_user_advanced", "/users/{id}/edit/advanced",

			




	
	
	
		
 
                  action="edit_advanced", conditions=dict(method=["GET"]))

			




	
	
	
		
 

			




	
	
	
		
 
        m.connect("edit_user_api_keys", "/users/{id}/edit/api_keys",

			




	
	
	
		
 
                  action="edit_api_keys", conditions=dict(method=["GET"]))

			




	
	
	
		
 
        m.connect("edit_user_api_keys", "/users/{id}/edit/api_keys",

			




	
	
	
		
 
                  action="add_api_key", conditions=dict(method=["POST"]))

			




	
	
	
		
 
        m.connect("edit_user_api_keys_delete", "/users/{id}/edit/api_keys/delete",

			




	
	
	
		
 
                  action="delete_api_key", conditions=dict(method=["POST"]))

			




	
	
	
		
 

			




	
	
	
		
 
        m.connect("edit_user_perms", "/users/{id}/edit/permissions",

			




	
	
	
		
 
                  action="edit_perms", conditions=dict(method=["GET"]))

			




	
	
	
		
 
        m.connect("edit_user_perms", "/users/{id}/edit/permissions",

			




	
	
	
		
 
                  action="update_perms", conditions=dict(method=["PUT"]))

			




	
	
	
		
 

			




	
	
	
		
 
        m.connect("edit_user_emails", "/users/{id}/edit/emails",

			




	
	
	
		
 
                  action="edit_emails", conditions=dict(method=["GET"]))

			




	
	
	
		
 
        m.connect("edit_user_emails_update", "/users/{id}/edit/emails",

			




	
	
	
		
 
                  action="add_email", conditions=dict(method=["POST"]))

			




	
	
	
		
 
        m.connect("edit_user_emails_delete", "/users/{id}/edit/emails/delete",

			




	
	
	
		
 
                  action="delete_email", conditions=dict(method=["POST"]))

			




	
	
	
		
 

			




	
	
	
		
 
        m.connect("edit_user_ips", "/users/{id}/edit/ips",

			




	
	
	
		
 
                  action="edit_ips", conditions=dict(method=["GET"]))

			




	
	
	
		
 
        m.connect("edit_user_ips_update", "/users/{id}/edit/ips",

			




	
	
	
		
 
                  action="add_ip", conditions=dict(method=["POST"]))

			




	
	
	
		
 
        m.connect("edit_user_ips_delete", "/users/{id}/edit/ips/delete",

			




	
	
	
		
 
                  action="delete_ip", conditions=dict(method=["POST"]))

			




	
	
	
		
 

			




	
	
	
		
 
    #ADMIN USER GROUPS REST ROUTES

			




	
	
	
		
 
    with rmap.submapper(path_prefix=ADMIN_PREFIX,

			




	
	
	
		
 
                        controller='admin/user_groups') as m:

			




	
	
	
		
 
        m.connect("users_groups", "/user_groups",

			




	
	
	
		
 
                  action="create", conditions=dict(method=["POST"]))

			




	
	
	
		
 
        m.connect("users_groups", "/user_groups",

			




	
	
	
		
 
                  action="index", conditions=dict(method=["GET"]))

			




	
	
	
		
 
        m.connect("new_users_group", "/user_groups/new",

			




	
	
	
		
 
                  action="new", conditions=dict(method=["GET"]))

			




	
	
	
		
 
        m.connect("update_users_group", "/user_groups/{id}",

			




	
	
	
		
 
                  action="update", conditions=dict(method=["PUT"]))

			




	
	
	
		
 
                  action="update", conditions=dict(method=["POST"]))

			




	
	
	
		
 
        m.connect("delete_users_group", "/user_groups/{id}/delete",

			




	
	
	
		
 
                  action="delete", conditions=dict(method=["POST"]))

			




	
	
	
		
 
        m.connect("edit_users_group", "/user_groups/{id}/edit",

			




	
	
	
		
 
                  action="edit", conditions=dict(method=["GET"]),

			




	
	
	
		
 
                  function=check_user_group)

			




	
	
	
		
 

			




	
	
	
		
 
        #EXTRAS USER GROUP ROUTES

			




	
	
	
		
 
        m.connect("edit_user_group_default_perms", "/user_groups/{id}/edit/default_perms",

			




	
	
	
		
 
                  action="edit_default_perms", conditions=dict(method=["GET"]))

			




	
	
	
		
 
        m.connect("edit_user_group_default_perms", "/user_groups/{id}/edit/default_perms",

			




	
	
	
		
 
                  action="update_default_perms", conditions=dict(method=["PUT"]))

			




	
	
	
		
 

			




	
	
	
		
 

			




	
	
	
		
 
        m.connect("edit_user_group_perms", "/user_groups/{id}/edit/perms",

			




	
	
	
		
 
                  action="edit_perms", conditions=dict(method=["GET"]))

			




	
	
	
		
 
        m.connect("edit_user_group_perms", "/user_groups/{id}/edit/perms",

			




	
	
	
		
 
                  action="update_perms", conditions=dict(method=["PUT"]))

			




	
	
	
		
 
        m.connect("edit_user_group_perms_delete", "/user_groups/{id}/edit/perms/delete",

			




	
	
	
		
 
                  action="delete_perms", conditions=dict(method=["POST"]))

			




	
	
	
		
 

			




	
	
	
		
 
        m.connect("edit_user_group_advanced", "/user_groups/{id}/edit/advanced",

			




	
	
	
		
 
                  action="edit_advanced", conditions=dict(method=["GET"]))

			




	
	
	
		
 

			




	
	
	
		
 
        m.connect("edit_user_group_members", "/user_groups/{id}/edit/members",

			




	
	
	
		
 
                  action="edit_members", conditions=dict(method=["GET"]))

			




	
	
	
		
 

			




	
	
	
		
 

			




	
	
	
		
 

			




	
	
	
		
 
    #ADMIN PERMISSIONS ROUTES

			




	
	
	
		
 
    with rmap.submapper(path_prefix=ADMIN_PREFIX,

			




	
	
	
		
 
                        controller='admin/permissions') as m:

			




	
	
	
		
 
        m.connect("admin_permissions", "/permissions",

			




	
	
	
		
 
                  action="permission_globals", conditions=dict(method=["POST"]))

			




	
	
	
		
 
        m.connect("admin_permissions", "/permissions",

			




	
	
	
		
 
                  action="permission_globals", conditions=dict(method=["GET"]))

			




	
	
	
		
 

			




	
	
	
		
 
        m.connect("admin_permissions_ips", "/permissions/ips",

			




	
	
	
		
 
                  action="permission_ips", conditions=dict(method=["GET"]))

			




	
	
	
		
 

			




	
	
	
		
 
        m.connect("admin_permissions_perms", "/permissions/perms",

			




	
	
	
		
 
                  action="permission_perms", conditions=dict(method=["GET"]))

			




	
	
	
		
 

			




	
	
	
		
 

			




	
	
	
		
 
    #ADMIN DEFAULTS ROUTES

			




	
	
	
		
 
    with rmap.submapper(path_prefix=ADMIN_PREFIX,

			




	
	
	
		
 
                        controller='admin/defaults') as m:

			




	
	
	
		
 
        m.connect('defaults', 'defaults',

			




	
	
	
		
 
                  action="index")

			




        

    


    
    

    

        

                

                    kallithea/controllers/admin/user_groups.py
                

                

                  
                      
                        

                      ➞

                      
                        
                  

                  
                      
                  
                      
                  
                      
                  
                      
                  
                  
                

                

                    Show inline comments
                    
                

        

        

            



	
	
		
 
@@ -149,97 +149,96 @@ class UserGroupsController(BaseControlle

			




	
	
	
		
 
            return htmlfill.render(

			




	
	
	
		
 
                render('admin/user_groups/user_group_add.html'),

			




	
	
	
		
 
                defaults=errors.value,

			




	
	
	
		
 
                errors=errors.error_dict or {},

			




	
	
	
		
 
                prefix_error=False,

			




	
	
	
		
 
                encoding="UTF-8",

			




	
	
	
		
 
                force_defaults=False)

			




	
	
	
		
 
        except Exception:

			




	
	
	
		
 
            log.error(traceback.format_exc())

			




	
	
	
		
 
            h.flash(_('Error occurred during creation of user group %s') \

			




	
	
	
		
 
                    % request.POST.get('users_group_name'), category='error')

			




	
	
	
		
 

			




	
	
	
		
 
        raise HTTPFound(location=url('users_groups'))

			




	
	
	
		
 

			




	
	
	
		
 
    @HasPermissionAnyDecorator('hg.admin', 'hg.usergroup.create.true')

			




	
	
	
		
 
    def new(self, format='html'):

			




	
	
	
		
 
        return render('admin/user_groups/user_group_add.html')

			




	
	
	
		
 

			




	
	
	
		
 
    @HasUserGroupPermissionAnyDecorator('usergroup.admin')

			




	
	
	
		
 
    def update(self, id):

			




	
	
	
		
 
        c.user_group = UserGroup.get_or_404(id)

			




	
	
	
		
 
        c.active = 'settings'

			




	
	
	
		
 
        self.__load_data(id)

			




	
	
	
		
 

			




	
	
	
		
 
        available_members = [safe_unicode(x[0]) for x in c.available_members]

			




	
	
	
		
 

			




	
	
	
		
 
        users_group_form = UserGroupForm(edit=True,

			




	
	
	
		
 
                                         old_data=c.user_group.get_dict(),

			




	
	
	
		
 
                                         available_members=available_members)()

			




	
	
	
		
 

			




	
	
	
		
 
        try:

			




	
	
	
		
 
            form_result = users_group_form.to_python(request.POST)

			




	
	
	
		
 
            UserGroupModel().update(c.user_group, form_result)

			




	
	
	
		
 
            gr = form_result['users_group_name']

			




	
	
	
		
 
            action_logger(self.authuser,

			




	
	
	
		
 
                          'admin_updated_users_group:%s' % gr,

			




	
	
	
		
 
                          None, self.ip_addr, self.sa)

			




	
	
	
		
 
            h.flash(_('Updated user group %s') % gr, category='success')

			




	
	
	
		
 
            Session().commit()

			




	
	
	
		
 
        except formencode.Invalid as errors:

			




	
	
	
		
 
            ug_model = UserGroupModel()

			




	
	
	
		
 
            defaults = errors.value

			




	
	
	
		
 
            e = errors.error_dict or {}

			




	
	
	
		
 
            defaults.update({

			




	
	
	
		
 
                'create_repo_perm': ug_model.has_perm(id,

			




	
	
	
		
 
                                                      'hg.create.repository'),

			




	
	
	
		
 
                'fork_repo_perm': ug_model.has_perm(id,

			




	
	
	
		
 
                                                    'hg.fork.repository'),

			




	
	
	
		
 
                '_method': 'put'

			




	
	
	
		
 
            })

			




	
	
	
		
 

			




	
	
	
		
 
            return htmlfill.render(

			




	
	
	
		
 
                render('admin/user_groups/user_group_edit.html'),

			




	
	
	
		
 
                defaults=defaults,

			




	
	
	
		
 
                errors=e,

			




	
	
	
		
 
                prefix_error=False,

			




	
	
	
		
 
                encoding="UTF-8",

			




	
	
	
		
 
                force_defaults=False)

			




	
	
	
		
 
        except Exception:

			




	
	
	
		
 
            log.error(traceback.format_exc())

			




	
	
	
		
 
            h.flash(_('Error occurred during update of user group %s') \

			




	
	
	
		
 
                    % request.POST.get('users_group_name'), category='error')

			




	
	
	
		
 

			




	
	
	
		
 
        raise HTTPFound(location=url('edit_users_group', id=id))

			




	
	
	
		
 

			




	
	
	
		
 
    @HasUserGroupPermissionAnyDecorator('usergroup.admin')

			




	
	
	
		
 
    def delete(self, id):

			




	
	
	
		
 
        usr_gr = UserGroup.get_or_404(id)

			




	
	
	
		
 
        try:

			




	
	
	
		
 
            UserGroupModel().delete(usr_gr)

			




	
	
	
		
 
            Session().commit()

			




	
	
	
		
 
            h.flash(_('Successfully deleted user group'), category='success')

			




	
	
	
		
 
        except UserGroupsAssignedException as e:

			




	
	
	
		
 
            h.flash(e, category='error')

			




	
	
	
		
 
        except Exception:

			




	
	
	
		
 
            log.error(traceback.format_exc())

			




	
	
	
		
 
            h.flash(_('An error occurred during deletion of user group'),

			




	
	
	
		
 
                    category='error')

			




	
	
	
		
 
        raise HTTPFound(location=url('users_groups'))

			




	
	
	
		
 

			




	
	
	
		
 
    @HasUserGroupPermissionAnyDecorator('usergroup.admin')

			




	
	
	
		
 
    def edit(self, id, format='html'):

			




	
	
	
		
 
        c.user_group = UserGroup.get_or_404(id)

			




	
	
	
		
 
        c.active = 'settings'

			




	
	
	
		
 
        self.__load_data(id)

			




	
	
	
		
 

			




	
	
	
		
 
        defaults = self.__load_defaults(id)

			




	
	
	
		
 

			




	
	
	
		
 
        return htmlfill.render(

			




	
	
	
		
 
            render('admin/user_groups/user_group_edit.html'),

			




	
	
	
		
 
            defaults=defaults,

			




	
	
	
		
 
            encoding="UTF-8",

			




	
	
	
		
 
            force_defaults=False

			




	
	
	
		
 
        )

			




	
	
	
		
 

			




	
	
	
		
 
    @HasUserGroupPermissionAnyDecorator('usergroup.admin')

			




	
	
	
		
 
    def edit_perms(self, id):

			




        

    


    
    

    

        

                

                    kallithea/templates/admin/user_groups/user_group_edit_settings.html
                

                

                  
                      
                        

                      ➞

                      
                        
                  

                  
                      
                  
                      
                  
                      
                  
                      
                  
                  
                

                

                    Show inline comments
                    
                

        

        

            



	
	
	
		
 
${h.form(url('users_group', id=c.user_group.users_group_id),method='put', id='edit_users_group')}

			




	
	
	
		
 
${h.form(url('update_users_group', id=c.user_group.users_group_id), id='edit_users_group')}

			




	
	
	
		
 
    <div class="form">

			




	
	
	
		
 
        <!-- fields -->

			




	
	
	
		
 
            <div class="fields">

			




	
	
	
		
 
                 <div class="field">

			




	
	
	
		
 
                    <div class="label">

			




	
	
	
		
 
                        <label for="users_group_name">${_('Group name')}:</label>

			




	
	
	
		
 
                    </div>

			




	
	
	
		
 
                    <div class="input">

			




	
	
	
		
 
                        ${h.text('users_group_name',class_='large')}

			




	
	
	
		
 
                    </div>

			




	
	
	
		
 
                 </div>

			




	
	
	
		
 
                 <div class="field">

			




	
	
	
		
 
                    <div class="label label-textarea">

			




	
	
	
		
 
                        <label for="user_group_description">${_('Description')}:</label>

			




	
	
	
		
 
                    </div>

			




	
	
	
		
 
                    <div class="textarea-small editor">

			




	
	
	
		
 
                        ${h.textarea('user_group_description')}

			




	
	
	
		
 
                        <span class="help-block">${_('Short, optional description for this user group.')}</span>

			




	
	
	
		
 
                    </div>

			




	
	
	
		
 
                 </div>

			




	
	
	
		
 
                 <div class="field">

			




	
	
	
		
 
                    <div class="label label-checkbox">

			




	
	
	
		
 
                        <label for="users_group_active">${_('Active')}:</label>

			




	
	
	
		
 
                    </div>

			




	
	
	
		
 
                    <div class="checkboxes">

			




	
	
	
		
 
                        ${h.checkbox('users_group_active',value=True)}

			




	
	
	
		
 
                    </div>

			




	
	
	
		
 
                 </div>

			




	
	
	
		
 
                <div class="field">

			




	
	
	
		
 
                    <div class="label">

			




	
	
	
		
 
                        <label for="users_group_active">${_('Members')}:</label>

			




	
	
	
		
 
                    </div>

			




	
	
	
		
 
                    <div class="select">

			




	
	
	
		
 
                        <table>

			




	
	
	
		
 
                                <tr>

			




	
	
	
		
 
                                    <td>

			




	
	
	
		
 
                                        <div>

			




	
	
	
		
 
                                            <div style="float:left">

			




	
	
	
		
 
                                                <div class="text" style="padding: 0px 0px 6px;">${_('Chosen group members')}</div>

			




	
	
	
		
 
                                                ${h.select('users_group_members',[],c.group_members,multiple=True,size=8,style="min-width:210px")}

			




	
	
	
		
 
                                            </div>

			




	
	
	
		
 
                                            <div style="float:left;width:20px;padding-top:50px">

			




	
	
	
		
 
                                                <i style="cursor:pointer; font-size: 16px" id="add_element" class="icon-left-open" title="Choose selected available"></i>

			




	
	
	
		
 
                                                <div style="height:50px"></div>

			




	
	
	
		
 
                                                <i style="cursor:pointer; font-size: 16px" id="remove_element" class="icon-right-open" title="Remove selected chosen"></i>

			




	
	
	
		
 
                                            </div>

			




	
	
	
		
 
                                            <div style="float:left">

			




	
	
	
		
 
                                                 <div class="text" style="padding: 0px 0px 6px;">${_('Available members')}</div>

			




        

    


    
    

    

        

                

                    kallithea/tests/functional/test_admin_user_groups.py
                

                

                  
                      
                        

                      ➞

                      
                        
                  

                  
                      
                  
                      
                  
                      
                  
                      
                  
                  
                

                

                    Show inline comments
                    
                

        

        

            



	
	
	
		
 
# -*- coding: utf-8 -*-

			




	
	
	
		
 
from kallithea.tests import *

			




	
	
	
		
 
from kallithea.model.db import UserGroup, UserGroupToPerm, Permission

			




	
	
	
		
 
from kallithea.model.meta import Session

			




	
	
	
		
 

			




	
	
	
		
 
TEST_USER_GROUP = u'admins_test'

			




	
	
	
		
 

			




	
	
	
		
 

			




	
	
	
		
 
class TestAdminUsersGroupsController(TestController):

			




	
	
	
		
 

			




	
	
	
		
 
    def test_index(self):

			




	
	
	
		
 
        self.log_user()

			




	
	
	
		
 
        response = self.app.get(url('users_groups'))

			




	
	
	
		
 
        # Test response...

			




	
	
	
		
 

			




	
	
	
		
 
    def test_create(self):

			




	
	
	
		
 
        self.log_user()

			




	
	
	
		
 
        users_group_name = TEST_USER_GROUP

			




	
	
	
		
 
        response = self.app.post(url('users_groups'),

			




	
	
	
		
 
                                 {'users_group_name': users_group_name,

			




	
	
	
		
 
                                  'user_group_description': u'DESC',

			




	
	
	
		
 
                                  'active': True,

			




	
	
	
		
 
                                  '_authentication_token': self.authentication_token()})

			




	
	
	
		
 
        response.follow()

			




	
	
	
		
 

			




	
	
	
		
 
        self.checkSessionFlash(response,

			




	
	
	
		
 
                               'Created user group <a href="/_admin/user_groups/')

			




	
	
	
		
 
        self.checkSessionFlash(response,

			




	
	
	
		
 
                               '/edit">%s</a>' % TEST_USER_GROUP)

			




	
	
	
		
 

			




	
	
	
		
 
    def test_new(self):

			




	
	
	
		
 
        response = self.app.get(url('new_users_group'))

			




	
	
	
		
 

			




	
	
	
		
 
    def test_update(self):

			




	
	
	
		
 
        response = self.app.put(url('users_group', id=1), status=403)

			




	
	
	
		
 
        response = self.app.post(url('update_users_group', id=1), status=403)

			




	
	
	
		
 

			




	
	
	
		
 
    def test_update_browser_fakeout(self):

			




	
	
	
		
 
        response = self.app.post(url('users_group', id=1),

			




	
	
	
		
 
                                 params=dict(_method='put', _authentication_token=self.authentication_token()))

			




	
	
	
		
 
        response = self.app.post(url('update_users_group', id=1),

			




	
	
	
		
 
                                 params=dict(_authentication_token=self.authentication_token()))

			




	
	
	
		
 

			




	
	
	
		
 
    def test_delete(self):

			




	
	
	
		
 
        self.log_user()

			




	
	
	
		
 
        users_group_name = TEST_USER_GROUP + 'another'

			




	
	
	
		
 
        response = self.app.post(url('users_groups'),

			




	
	
	
		
 
                                 {'users_group_name':users_group_name,

			




	
	
	
		
 
                                  'user_group_description': u'DESC',

			




	
	
	
		
 
                                  'active': True,

			




	
	
	
		
 
                                  '_authentication_token': self.authentication_token()})

			




	
	
	
		
 
        response.follow()

			




	
	
	
		
 

			




	
	
	
		
 
        self.checkSessionFlash(response,

			




	
	
	
		
 
                               'Created user group ')

			




	
	
	
		
 

			




	
	
	
		
 
        gr = Session().query(UserGroup) \

			




	
	
	
		
 
            .filter(UserGroup.users_group_name == users_group_name).one()

			




	
	
	
		
 

			




	
	
	
		
 
        response = self.app.post(url('delete_users_group', id=gr.users_group_id),

			




	
	
	
		
 
            params={'_authentication_token': self.authentication_token()})

			




	
	
	
		
 

			




	
	
	
		
 
        gr = Session().query(UserGroup) \

			




	
	
	
		
 
            .filter(UserGroup.users_group_name == users_group_name).scalar()

			




	
	
	
		
 

			




	
	
	
		
 
        assert gr == None

			




	
	
	
		
 

			




	
	
	
		
 
    def test_default_perms_enable_repository_read_on_group(self):

			




	
	
	
		
 
        self.log_user()

			




	
	
	
		
 
        users_group_name = TEST_USER_GROUP + 'another2'

			




	
	
	
		
 
        response = self.app.post(url('users_groups'),

			




	
	
	
		
 
                                 {'users_group_name': users_group_name,

			




	
	
	
		
 
                                  'user_group_description': u'DESC',

			




	
	
	
		
 
                                  'active': True,

			




	
	
	
		
 
                                  '_authentication_token': self.authentication_token()})

			




	
	
	
		
 
        response.follow()

			




	
	
	
		
 

			




	
	
	
		
 
        ug = UserGroup.get_by_group_name(users_group_name)

			




	
	
	
		
 
        self.checkSessionFlash(response,

			




	
	
	
		
 
                               'Created user group ')

			




	
	
	
		
 
        ## ENABLE REPO CREATE ON A GROUP

			




	
	
	
		
 
        response = self.app.put(url('edit_user_group_default_perms',

			




	
	
	
		
 
                                    id=ug.users_group_id),

			




	
	
	
		
 
                                 {'create_repo_perm': True,

			




	
	
	
		
 
                                  '_authentication_token': self.authentication_token()})

			




	
	
	
		
 
        response.follow()

			




	
	
	
		
 
        ug = UserGroup.get_by_group_name(users_group_name)

			




	
	
	
		
 
        p = Permission.get_by_key('hg.create.repository')

			




	
	
	
		
 
        p2 = Permission.get_by_key('hg.usergroup.create.false')

			




	
	
	
		
 
        p3 = Permission.get_by_key('hg.fork.none')

			




        

    



    


    



    



      

      





    
    0 comments (0 inline, 0 general)
    





    


  

  







  


    




    








    
        
    
    
        This site is powered by
            Kallithea 0.7.0,
        which is
        © 2010–2025 by various authors & licensed under GPLv3.