From 83bfaf14a8536816d2957b95168dfc8227f4e978 Mon Sep 17 00:00:00 2001 From: Matt Westcott Date: Tue, 26 Apr 2016 11:51:14 +0100 Subject: [PATCH] failing test for #2511 for document uploader Make collection field on document chooser upload respect user permissions failing test for #2511 for image uploader Make collection field on image chooser upload respect user permissions --- CHANGELOG.txt | 3 +- docs/releases/1.5.rst | 5 +- wagtail/wagtaildocs/tests.py | 72 +++++++++++++++++++ wagtail/wagtaildocs/views/chooser.py | 6 +- .../wagtailimages/tests/test_admin_views.py | 69 ++++++++++++++++++ wagtail/wagtailimages/views/chooser.py | 6 +- 6 files changed, 152 insertions(+), 9 deletions(-) diff --git a/CHANGELOG.txt b/CHANGELOG.txt index 389ac38a1..029f27e44 100644 --- a/CHANGELOG.txt +++ b/CHANGELOG.txt @@ -32,7 +32,8 @@ Changelog * Fix: Direct usage of `Document` model replaced with `get_document_model` function in `wagtail.contrib.wagtailmedusa` and in `wagtail.contrib.wagtailapi` * Fix: Failures on sending moderation notification emails now produce a warning, rather than crashing the admin page outright (Matt Fozard) * Fix: All admin forms that could potentially include file upload fields now specify `multipart/form-data` where appropriate (Tim Heap) -* Fix: REM units in Wagtailuserbar caused incorrect spacing (Vincent Audebert) + * Fix: REM units in Wagtailuserbar caused incorrect spacing (Vincent Audebert) + * Fix: Now user can upload images / documents only into permitted collection from choosers 1.4.4 (xx.xx.2016) diff --git a/docs/releases/1.5.rst b/docs/releases/1.5.rst index a26906d67..11259dbe6 100644 --- a/docs/releases/1.5.rst +++ b/docs/releases/1.5.rst @@ -60,8 +60,9 @@ Bug fixes * Registered settings admin menu items now show active correctly (Matthew Downey) * Direct usage of ``Document`` model replaced with ``get_document_model`` function in ``wagtail.contrib.wagtailmedusa`` and in ``wagtail.contrib.wagtailapi`` * Failures on sending moderation notification emails now produce a warning, rather than crashing the admin page outright (Matt Fozard) -* Fix: All admin forms that could potentially include file upload fields now specify ``multipart/form-data`` where appropriate (Tim Heap) -* Fix: REM units in Wagtailuserbar caused incorrect spacing (Vincent Audebert) + * All admin forms that could potentially include file upload fields now specify ``multipart/form-data`` where appropriate (Tim Heap) + * REM units in Wagtailuserbar caused incorrect spacing (Vincent Audebert) + * Now user can upload images / documents only into permitted collection from choosers Upgrade considerations diff --git a/wagtail/wagtaildocs/tests.py b/wagtail/wagtaildocs/tests.py index 15c8b64bc..4199d5d88 100644 --- a/wagtail/wagtaildocs/tests.py +++ b/wagtail/wagtaildocs/tests.py @@ -732,6 +732,78 @@ class TestDocumentChooserUploadView(TestCase, WagtailTestUtils): self.assertTrue(models.Document.objects.filter(title="Test document").exists()) +class TestDocumentChooserUploadViewWithLimitedPermissions(TestCase, WagtailTestUtils): + def setUp(self): + add_doc_permission = Permission.objects.get( + content_type__app_label='wagtaildocs', codename='add_document' + ) + admin_permission = Permission.objects.get( + content_type__app_label='wagtailadmin', codename='access_admin' + ) + + root_collection = Collection.get_first_root_node() + self.evil_plans_collection = root_collection.add_child(name="Evil plans") + + conspirators_group = Group.objects.create(name="Evil conspirators") + conspirators_group.permissions.add(admin_permission) + GroupCollectionPermission.objects.create( + group=conspirators_group, + collection=self.evil_plans_collection, + permission=add_doc_permission + ) + + user = get_user_model().objects.create_user( + username='moriarty', + email='moriarty@example.com', + password='password' + ) + user.groups.add(conspirators_group) + + self.client.login(username='moriarty', password='password') + + def test_simple(self): + response = self.client.get(reverse('wagtaildocs:chooser_upload')) + self.assertEqual(response.status_code, 200) + self.assertTemplateUsed(response, 'wagtaildocs/chooser/chooser.html') + self.assertTemplateUsed(response, 'wagtaildocs/chooser/chooser.js') + + # user only has access to one collection -> should not see the collections field + self.assertNotContains(response, 'id_collection') + + def test_chooser_view(self): + # The main chooser view also includes the form, so need to test there too + response = self.client.get(reverse('wagtaildocs:chooser')) + self.assertEqual(response.status_code, 200) + self.assertTemplateUsed(response, 'wagtaildocs/chooser/chooser.html') + self.assertTemplateUsed(response, 'wagtaildocs/chooser/chooser.js') + + # user only has access to one collection -> should not see the collections field + self.assertNotContains(response, 'id_collection') + + def test_post(self): + # Build a fake file + fake_file = ContentFile(b("A boring example document")) + fake_file.name = 'test.txt' + + # Submit + post_data = { + 'title': "Test document", + 'file': fake_file, + } + response = self.client.post(reverse('wagtaildocs:chooser_upload'), post_data) + + # Check that the response is a javascript file saying the document was chosen + self.assertTemplateUsed(response, 'wagtaildocs/chooser/document_chosen.js') + self.assertContains(response, "modal.respond('documentChosen'") + + # Document should be created + doc = models.Document.objects.filter(title="Test document") + self.assertTrue(doc.exists()) + + # Document should be in the 'evil plans' collection + self.assertEqual(doc.get().collection, self.evil_plans_collection) + + class TestDocumentFilenameProperties(TestCase): def setUp(self): self.document = models.Document(title="Test document") diff --git a/wagtail/wagtaildocs/views/chooser.py b/wagtail/wagtaildocs/views/chooser.py index 9f9ee8a5f..92d08c4cb 100644 --- a/wagtail/wagtaildocs/views/chooser.py +++ b/wagtail/wagtaildocs/views/chooser.py @@ -36,7 +36,7 @@ def chooser(request): if permission_policy.user_has_permission(request.user, 'add'): DocumentForm = get_document_form(Document) - uploadform = DocumentForm() + uploadform = DocumentForm(user=request.user) else: uploadform = None @@ -104,7 +104,7 @@ def chooser_upload(request): if request.method == 'POST': document = Document(uploaded_by_user=request.user) - form = DocumentForm(request.POST, request.FILES, instance=document) + form = DocumentForm(request.POST, request.FILES, instance=document, user=request.user) if form.is_valid(): form.save() @@ -118,7 +118,7 @@ def chooser_upload(request): {'document_json': get_document_json(document)} ) else: - form = DocumentForm() + form = DocumentForm(user=request.user) documents = Document.objects.order_by('title') diff --git a/wagtail/wagtailimages/tests/test_admin_views.py b/wagtail/wagtailimages/tests/test_admin_views.py index cef123066..0708c6338 100644 --- a/wagtail/wagtailimages/tests/test_admin_views.py +++ b/wagtail/wagtailimages/tests/test_admin_views.py @@ -504,6 +504,75 @@ class TestImageChooserUploadView(TestCase, WagtailTestUtils): self.assertTrue(Image.objects.filter(title="Test image").exists()) +class TestImageChooserUploadViewWithLimitedPermissions(TestCase, WagtailTestUtils): + def setUp(self): + add_image_permission = Permission.objects.get( + content_type__app_label='wagtailimages', codename='add_image' + ) + admin_permission = Permission.objects.get( + content_type__app_label='wagtailadmin', codename='access_admin' + ) + + root_collection = Collection.get_first_root_node() + self.evil_plans_collection = root_collection.add_child(name="Evil plans") + + conspirators_group = Group.objects.create(name="Evil conspirators") + conspirators_group.permissions.add(admin_permission) + GroupCollectionPermission.objects.create( + group=conspirators_group, + collection=self.evil_plans_collection, + permission=add_image_permission + ) + + user = get_user_model().objects.create_user( + username='moriarty', + email='moriarty@example.com', + password='password' + ) + user.groups.add(conspirators_group) + + self.client.login(username='moriarty', password='password') + + def test_get(self): + response = self.client.get(reverse('wagtailimages:chooser_upload')) + self.assertEqual(response.status_code, 200) + self.assertTemplateUsed(response, 'wagtailimages/chooser/chooser.html') + + # user only has access to one collection, so no 'Collection' option + # is displayed on the form + self.assertNotContains(response, '