Browse Source

Permissions and default group-related tests

Jon Natkins 13 years ago
parent
commit
772d6cae76
2 changed files with 36 additions and 1 deletions
  1. 32 0
      apps/useradmin/src/useradmin/tests.py
  2. 4 1
      apps/useradmin/src/useradmin/views.py

+ 32 - 0
apps/useradmin/src/useradmin/tests.py

@@ -135,6 +135,10 @@ def test_group_permissions():
   assert_true(get_profile(test_user).has_hue_permission('access','useradmin'))
   assert_true(get_profile(test_user).has_hue_permission('access','useradmin'))
   assert_true('Hue Users' in response.content)
   assert_true('Hue Users' in response.content)
 
 
+  # Make sure we can't modify permissions
+  response = c1.get('/useradmin/permissions/edit/useradmin/access')
+  assert_true('must be a superuser to change permissions' in response.content)
+
   # And revoke access from the group
   # And revoke access from the group
   c.post('/useradmin/permissions/edit/useradmin/access',
   c.post('/useradmin/permissions/edit/useradmin/access',
          dict(app='useradmin',
          dict(app='useradmin',
@@ -148,6 +152,25 @@ def test_group_permissions():
   response = c1.get('/useradmin/users')
   response = c1.get('/useradmin/users')
   assert_true('You do not have permission to access the Useradmin application.' in response.content)
   assert_true('You do not have permission to access the Useradmin application.' in response.content)
 
 
+
+def test_default_group():
+  reset_all_users()
+  reset_all_groups()
+
+  c = make_logged_in_client(username='test', is_superuser=True)
+
+  # Try deleting the default group
+  useradmin.conf.DEFAULT_USER_GROUP.set_for_testing('test_default')
+  response = c.post('/useradmin/groups/delete/test_default')
+  assert_true('default user group may not be deleted' in response.content)
+  assert_true(Group.objects.filter(name='test_default').exists())
+
+  # Change the name of the default group, and try deleting again
+  useradmin.conf.DEFAULT_USER_GROUP.set_for_testing('new_default')
+  response = c.post('/useradmin/groups/delete/test_default')
+  assert_false(Group.objects.filter(name='test_default').exists())
+  assert_true(Group.objects.filter(name='new_default').exists())
+
 def test_group_admin():
 def test_group_admin():
   reset_all_users()
   reset_all_users()
   reset_all_groups()
   reset_all_groups()
@@ -187,11 +210,20 @@ def test_group_admin():
   test_user.groups.add(Group.objects.get(name="access-group"))
   test_user.groups.add(Group.objects.get(name="access-group"))
   test_user.save()
   test_user.save()
 
 
+  # Make sure non-superusers can't do bad things
   response = c2.get('/useradmin/groups/new')
   response = c2.get('/useradmin/groups/new')
   assert_true("You must be a superuser" in response.content)
   assert_true("You must be a superuser" in response.content)
   response = c2.get('/useradmin/groups/edit/testgroup')
   response = c2.get('/useradmin/groups/edit/testgroup')
   assert_true("You must be a superuser" in response.content)
   assert_true("You must be a superuser" in response.content)
 
 
+  response = c2.post('/useradmin/groups/new', dict(name="nonsuperuser"))
+  assert_true("You must be a superuser" in response.content)
+  response = c2.post('/useradmin/groups/edit/testgroup',
+                    dict(name="nonsuperuser",
+                    members=[User.objects.get(username="test").pk],
+                    save="Save"), follow=True)
+  assert_true("You must be a superuser" in response.content)
+ 
   # Should be one group left, because we created the other group
   # Should be one group left, because we created the other group
   response = c.post('/useradmin/groups/delete/testgroup')
   response = c.post('/useradmin/groups/delete/testgroup')
   assert_true(len(Group.objects.all()) == 1)
   assert_true(len(Group.objects.all()) == 1)

+ 4 - 1
apps/useradmin/src/useradmin/views.py

@@ -82,8 +82,11 @@ def delete_group(request, name):
       global groups_lock
       global groups_lock
       __groups_lock.acquire()
       __groups_lock.acquire()
       try:
       try:
-        group = Group.objects.get(name=name)
+        # Get the default group before getting the group, because we may be
+        # trying to delete the default group, and it may not have been created
+        # yet
         default_group = get_default_user_group()
         default_group = get_default_user_group()
+        group = Group.objects.get(name=name)
         if default_group is not None and default_group.name == name:
         if default_group is not None and default_group.name == name:
           raise PopupException("The default user group may not be deleted.")
           raise PopupException("The default user group may not be deleted.")
         group.delete()
         group.delete()