[fix] Fixed authorization bug in get_default_templates view #420 - #422
Conversation
9648543 to
cfd2add
Compare
nemesifier
left a comment
There was a problem hiding this comment.
looks good! Here's a speedy review, will test later today.
| if ( | ||
| not authenticated | ||
| or not user.is_staff | ||
| or (not user.is_superuser and organization_id not in user.organizations_managed) |
There was a problem hiding this comment.
I would use https://github.com/openwisp/openwisp-users/#is-manager-org since in this case should make it more readable
| django.jQuery(function ($) { | ||
| var firstRun = true, | ||
| addChangeEventToBackend = function (urls) { | ||
| addChangeEventToBackend = function (url_schema) { |
There was a problem hiding this comment.
in JS let's use camelCase, urlSchema
| ctx.update({'default_template_urls': self._get_default_template_urls()}) | ||
| ctx.update( | ||
| { | ||
| 'default_template_urls': reverse( |
There was a problem hiding this comment.
we can call it default_template_url (singular)
| ctx.update({'default_template_urls': self._get_default_template_urls()}) | ||
| ctx.update( | ||
| { | ||
| 'default_template_url_schema': reverse( |
There was a problem hiding this comment.
I think we can just call it default_template_url
cfd2add to
0929ccf
Compare
| if ( | ||
| not authenticated | ||
| or not user.is_staff | ||
| or (not user.is_superuser and user.is_manager(organization_id)) |
There was a problem hiding this comment.
shouldn't it be as follows?
or (not user.is_superuser and not user.is_manager(organization_id))I did some manual testing with a staff user, non superuser, which has access only to one org, but I was still able to access the URL for the other orgs in the system.
There was a problem hiding this comment.
Yes you are right. This was an overlook.
I did some manual testing with a staff user, non superuser, which has access only to one org, but I was still able to access the URL for the other orgs in the system.
Did you also test after making that suggested change? After making this change, it worked fine as expected.
a1c2d98 to
5f6e7e8
Compare
Instead of creating a dict of URLs for all organization, substitute organization_id in URL Schema.
5f6e7e8 to
67752a1
Compare
A non-superuser can only request default templates for organizations it manages Closes #420
67752a1 to
22dfca9
Compare
nemesifier
left a comment
There was a problem hiding this comment.
Tested thoroughly, works right, thanks! 👍
Optimized fetching default templates using URL schema.
A non-superuser can only request default templates for organizations it manages
Closes #420