Changeset - 493ccf3e22e6
[Not reviewed]
default
0 1 0
Mads Kiilerich - 11 years ago 2014-07-14 21:12:23
madski@unity3d.com
user edit: always define c.EXTERN_TYPE_INTERNAL (issue 3)

It is needed by user_edit_profile.html when user_edit.html includes it because
.active='profile'. Some non-obvious code paths could lead to that - such as
editing other user's password.

Instead, set the value it in the controller initialization.
1 file changed with 1 insertions and 1 deletions:
0 comments (0 inline, 0 general)
kallithea/controllers/admin/users.py
Show inline comments
 
@@ -63,12 +63,13 @@ class UsersController(BaseController):
 

	
 
    @LoginRequired()
 
    @HasPermissionAllDecorator('hg.admin')
 
    def __before__(self):
 
        super(UsersController, self).__before__()
 
        c.available_permissions = config['available_permissions']
 
        c.EXTERN_TYPE_INTERNAL = kallithea.EXTERN_TYPE_INTERNAL
 

	
 
    def index(self, format='html'):
 
        """GET /users: All items in the collection"""
 
        # url('users')
 

	
 
        c.users_list = User.query().order_by(User.username)\
 
@@ -242,13 +243,12 @@ class UsersController(BaseController):
 
            h.flash(_("You can't edit this user"), category='warning')
 
            return redirect(url('users'))
 

	
 
        c.active = 'profile'
 
        c.extern_type = c.user.extern_type
 
        c.extern_name = c.user.extern_name
 
        c.EXTERN_TYPE_INTERNAL = kallithea.EXTERN_TYPE_INTERNAL
 
        c.perm_user = AuthUser(user_id=id, ip_addr=self.ip_addr)
 

	
 
        defaults = c.user.get_dict()
 
        return htmlfill.render(
 
            render('admin/users/user_edit.html'),
 
            defaults=defaults,
0 comments (0 inline, 0 general)