Changeset - dc7e37ec3dfd
[Not reviewed]
default
0 2 0
domruf - 8 years ago 2017-11-23 22:16:34
dominikruf@gmail.com
Grafted from: ebaf649bc81e
auth: users_and_groups_data should not be available for anonymous/default user
2 files changed with 5 insertions and 2 deletions:
0 comments (0 inline, 0 general)
kallithea/controllers/home.py
Show inline comments
 
@@ -52,161 +52,161 @@ class HomeController(BaseController):
 

	
 
    @LoginRequired(allow_default_user=True)
 
    def index(self):
 
        c.group = None
 

	
 
        repo_groups_list = self.scm_model.get_repo_groups()
 
        repos_list = Repository.query(sorted=True).filter_by(group=None).all()
 

	
 
        c.data = RepoModel().get_repos_as_dict(repos_list=repos_list,
 
                                               repo_groups_list=repo_groups_list,
 
                                               admin=False, short_name=True)
 

	
 
        return render('/index.html')
 

	
 
    @LoginRequired(allow_default_user=True)
 
    @jsonify
 
    def repo_switcher_data(self):
 
        # wrapper for conditional cache
 
        def _c():
 
            log.debug('generating switcher repo/groups list')
 
            all_repos = Repository.query(sorted=True).all()
 
            repo_iter = self.scm_model.get_repos(all_repos)
 
            all_groups = RepoGroup.query(sorted=True).all()
 
            repo_groups_iter = self.scm_model.get_repo_groups(all_groups)
 

	
 
            res = [{
 
                    'text': _('Groups'),
 
                    'children': [
 
                       {'id': obj.group_name,
 
                        'text': obj.group_name,
 
                        'type': 'group',
 
                        'obj': {}}
 
                       for obj in repo_groups_iter
 
                    ],
 
                   },
 
                   {
 
                    'text': _('Repositories'),
 
                    'children': [
 
                       {'id': obj.repo_name,
 
                        'text': obj.repo_name,
 
                        'type': 'repo',
 
                        'obj': obj.get_dict()}
 
                       for obj in repo_iter
 
                    ],
 
                   }]
 

	
 
            data = {
 
                'more': False,
 
                'results': res,
 
            }
 
            return data
 

	
 
        if request.is_xhr:
 
            condition = False
 
            compute = conditional_cache('short_term', 'cache_desc',
 
                                        condition=condition, func=_c)
 
            return compute()
 
        else:
 
            raise HTTPBadRequest()
 

	
 
    @LoginRequired(allow_default_user=True)
 
    @HasRepoPermissionLevelDecorator('read')
 
    @jsonify
 
    def repo_refs_data(self, repo_name):
 
        repo = Repository.get_by_repo_name(repo_name).scm_instance
 
        res = []
 
        _branches = repo.branches.items()
 
        if _branches:
 
            res.append({
 
                'text': _('Branch'),
 
                'children': [{'id': rev, 'text': name, 'type': 'branch'} for name, rev in _branches]
 
            })
 
        _closed_branches = repo.closed_branches.items()
 
        if _closed_branches:
 
            res.append({
 
                'text': _('Closed Branches'),
 
                'children': [{'id': rev, 'text': name, 'type': 'closed-branch'} for name, rev in _closed_branches]
 
            })
 
        _tags = repo.tags.items()
 
        if _tags:
 
            res.append({
 
                'text': _('Tag'),
 
                'children': [{'id': rev, 'text': name, 'type': 'tag'} for name, rev in _tags]
 
            })
 
        _bookmarks = repo.bookmarks.items()
 
        if _bookmarks:
 
            res.append({
 
                'text': _('Bookmark'),
 
                'children': [{'id': rev, 'text': name, 'type': 'book'} for name, rev in _bookmarks]
 
            })
 
        data = {
 
            'more': False,
 
            'results': res
 
        }
 
        return data
 

	
 
    @LoginRequired(allow_default_user=True)
 
    @LoginRequired()
 
    @jsonify
 
    def users_and_groups_data(self):
 
        """
 
        Returns 'results' with a list of users and user groups.
 

	
 
        You can either use the 'key' GET parameter to get a user by providing
 
        the exact user key or you can use the 'query' parameter to
 
        search for users by user key, first name and last name.
 
        'types' defaults to just 'users' but can be set to 'users,groups' to
 
        get both users and groups.
 
        No more than 500 results (of each kind) will be returned.
 
        """
 
        types = request.GET.get('types', 'users').split(',')
 
        key = request.GET.get('key', '')
 
        query = request.GET.get('query', '')
 
        results = []
 
        if 'users' in types:
 
            user_list = []
 
            if key:
 
                u = User.get_by_username(key)
 
                if u:
 
                    user_list = [u]
 
            elif query:
 
                user_list = User.query() \
 
                    .filter(User.is_default_user == False) \
 
                    .filter(User.active == True) \
 
                    .filter(or_(
 
                        User.username.ilike("%%"+query+"%%"),
 
                        User.name.ilike("%%"+query+"%%"),
 
                        User.lastname.ilike("%%"+query+"%%"),
 
                    )) \
 
                    .order_by(User.username) \
 
                    .limit(500) \
 
                    .all()
 
            for u in user_list:
 
                results.append({
 
                    'type': 'user',
 
                    'id': u.user_id,
 
                    'nname': u.username,
 
                    'fname': u.name,
 
                    'lname': u.lastname,
 
                    'gravatar_lnk': h.gravatar_url(u.email, size=28, default='default'),
 
                    'gravatar_size': 14,
 
                })
 
        if 'groups' in types:
 
            grp_list = []
 
            if key:
 
                grp = UserGroup.get_by_group_name(key)
 
                if grp:
 
                    grp_list = [grp]
 
            elif query:
 
                grp_list = UserGroup.query() \
 
                    .filter(UserGroup.users_group_name.ilike("%%"+query+"%%")) \
 
                    .filter(UserGroup.users_group_active == True) \
 
                    .order_by(UserGroup.users_group_name) \
 
                    .limit(500) \
 
                    .all()
 
            for g in UserGroupList(grp_list, perm_level='read'):
 
                results.append({
 
                    'type': 'group',
 
                    'id': g.users_group_id,
 
                    'grname': g.users_group_name,
 
                })
 
        return dict(results=results)
kallithea/tests/functional/test_home.py
Show inline comments
 
# -*- coding: utf-8 -*-
 
import json
 

	
 
from kallithea.tests.base import *
 
from kallithea.tests.fixture import Fixture
 
from kallithea.model.meta import Session
 
from kallithea.model.db import Repository
 
from kallithea.model.repo import RepoModel
 
from kallithea.model.repo_group import RepoGroupModel
 

	
 

	
 
fixture = Fixture()
 

	
 

	
 
class TestHomeController(TestController):
 

	
 
    def test_index(self):
 
        self.log_user()
 
        response = self.app.get(url(controller='home', action='index'))
 
        # if global permission is set
 
        response.mustcontain('Add Repository')
 

	
 
        response.mustcontain(
 
            """<span class="label label-repo" title="Git repository">git"""
 
        )
 

	
 
        response.mustcontain(
 
            """<span class="label label-repo" title="Mercurial repository">hg"""
 
        )
 

	
 
        # html in javascript variable:
 
        response.mustcontain(r'href=\"/%s\"' % HG_REPO)
 

	
 
        response.mustcontain(r'\x3ci class=\"icon-globe\"')
 

	
 
        response.mustcontain(r'\"fixes issue with having custom format for git-log\n\"')
 
        response.mustcontain(r'\"/%s/changeset/5f2c6ee195929b0be80749243c18121c9864a3b3\"' % GIT_REPO)
 

	
 
        response.mustcontain(r'\"disable security checks on hg clone for travis\"')
 
        response.mustcontain(r'\"/%s/changeset/96507bd11ecc815ebc6270fdf6db110928c09c1e\"' % HG_REPO)
 

	
 
    def test_repo_summary_with_anonymous_access_disabled(self):
 
        with fixture.anon_access(False):
 
            response = self.app.get(url(controller='summary',
 
                                        action='index', repo_name=HG_REPO),
 
                                        status=302)
 
            assert 'login' in response.location
 

	
 
    def test_index_with_anonymous_access_disabled(self):
 
        with fixture.anon_access(False):
 
            response = self.app.get(url(controller='home', action='index'),
 
                                    status=302)
 
            assert 'login' in response.location
 

	
 
    def test_index_page_on_groups(self):
 
        self.log_user()
 
        gr = fixture.create_repo_group(u'gr1')
 
        fixture.create_repo(name=u'gr1/repo_in_group', repo_group=gr)
 
        response = self.app.get(url('repos_group_home', group_name=u'gr1'))
 

	
 
        try:
 
            response.mustcontain(u"gr1/repo_in_group")
 
        finally:
 
            RepoModel().delete(u'gr1/repo_in_group')
 
            RepoGroupModel().delete(repo_group=u'gr1', force_delete=True)
 
            Session().commit()
 

	
 
    def test_users_and_groups_data(self):
 
        self.log_user()
 
        fixture.create_user('evil', firstname=u'D\'o\'ct"o"r', lastname=u'Évíl')
 
        fixture.create_user_group(u'grrrr', user_group_description=u"Groüp")
 
        response = self.app.get(url('users_and_groups_data', query=u'evi'))
 
        assert response.status_code == 302
 
        assert url('login_home') in response.location
 
        self.log_user(TEST_USER_REGULAR_LOGIN, TEST_USER_REGULAR_PASS)
 
        response = self.app.get(url('users_and_groups_data', query=u'evi'))
 
        result = json.loads(response.body)['results']
 
        assert result[0].get('fname') == u'D\'o\'ct"o"r'
 
        assert result[0].get('lname') == u'Évíl'
 
        response = self.app.get(url('users_and_groups_data', key=u'evil'))
 
        result = json.loads(response.body)['results']
 
        assert result[0].get('fname') == u'D\'o\'ct"o"r'
 
        assert result[0].get('lname') == u'Évíl'
 
        response = self.app.get(url('users_and_groups_data', query=u'rrrr'))
 
        result = json.loads(response.body)['results']
 
        assert not result
 
        response = self.app.get(url('users_and_groups_data', types='users,groups', query=u'rrrr'))
 
        result = json.loads(response.body)['results']
 
        assert result[0].get('grname') == u'grrrr'
0 comments (0 inline, 0 general)