Эх сурвалжийг харах

Add a group edit control to the Create/Edit User page

It also makes sense to differentiate between the create/edit pages that
superusers and regular users see. Certain controls won't be modified by regular
users, so this introduces a separate superuser user change form.
Jon Natkins 13 жил өмнө
parent
commit
dd0e5ccb71

+ 10 - 11
apps/useradmin/src/useradmin/tests.py

@@ -263,12 +263,19 @@ def test_user_admin():
   group = Group.objects.create(name="test-group")
   group = Group.objects.create(name="test-group")
   perm = HuePermission.objects.get(app='useradmin', action='access')
   perm = HuePermission.objects.get(app='useradmin', action='access')
   GroupPermission.objects.create(group=group, hue_permission=perm)
   GroupPermission.objects.create(group=group, hue_permission=perm)
-  test_user = User.objects.get(username=FUNNY_NAME)
-  test_user.groups.add(Group.objects.get(name="test-group"))
-  test_user.save()
+
+  # Verify that we can modify user groups through the user admin pages
+  response = c.post('/useradmin/users/new', dict(username="group_member", password1="test", password2="test", groups=[group.pk]))
+  User.objects.get(username='group_member')
+  assert_true(User.objects.get(username='group_member').groups.filter(name='test-group').exists())
+  response = c.post('/useradmin/users/edit/group_member', dict(username="group_member", password1="test", password2="test", groups=[]))
+  assert_false(User.objects.get(username='group_member').groups.filter(name='test-group').exists())
 
 
   # Check permissions by logging in as the new user
   # Check permissions by logging in as the new user
   c_reg = make_logged_in_client(username=FUNNY_NAME, password="test")
   c_reg = make_logged_in_client(username=FUNNY_NAME, password="test")
+  test_user = User.objects.get(username=FUNNY_NAME)
+  test_user.groups.add(Group.objects.get(name="test-group"))
+  test_user.save()
 
 
   # Regular user should be able to modify oneself
   # Regular user should be able to modify oneself
   response = c_reg.post('/useradmin/users/edit/%s' % (FUNNY_NAME_QUOTED,),
   response = c_reg.post('/useradmin/users/edit/%s' % (FUNNY_NAME_QUOTED,),
@@ -281,14 +288,6 @@ def test_user_admin():
   response = c_reg.post("/useradmin/users/delete/test")
   response = c_reg.post("/useradmin/users/delete/test")
   assert_true("You must be a superuser" in response.content,
   assert_true("You must be a superuser" in response.content,
               "Regular user can't edit other people")
               "Regular user can't edit other people")
-  # Regular user should not be able to self-promote to superuser
-  response = c_reg.post('/useradmin/users/edit/%s' % (FUNNY_NAME_QUOTED,),
-                        dict(username = FUNNY_NAME,
-                             first_name = "OLÁ",
-                             is_superuser = True,
-                             is_active = True))
-  assert_true("You cannot" in response.content,
-              "Regular users can't self-promote to superuser")
 
 
   # Revert to regular "test" user, that has superuser powers.
   # Revert to regular "test" user, that has superuser powers.
   c_su = make_logged_in_client()
   c_su = make_logged_in_client()

+ 26 - 3
apps/useradmin/src/useradmin/views.py

@@ -109,7 +109,7 @@ class UserChangeForm(django.contrib.auth.forms.UserChangeForm):
   password2 = forms.CharField(label="Password confirmation", widget=forms.PasswordInput, required=False)
   password2 = forms.CharField(label="Password confirmation", widget=forms.PasswordInput, required=False)
 
 
   class Meta(django.contrib.auth.forms.UserChangeForm.Meta):
   class Meta(django.contrib.auth.forms.UserChangeForm.Meta):
-    fields = ["username", "first_name", "last_name", "email", "is_active", "is_superuser"]
+    fields = ["username", "first_name", "last_name", "email"]
 
 
   def clean_password2(self):
   def clean_password2(self):
     password1 = self.cleaned_data.get("password1", "")
     password1 = self.cleaned_data.get("password1", "")
@@ -133,8 +133,26 @@ class UserChangeForm(django.contrib.auth.forms.UserChangeForm):
       user.set_password(self.cleaned_data["password1"])
       user.set_password(self.cleaned_data["password1"])
     if commit:
     if commit:
       user.save()
       user.save()
+      # groups must be saved after the user
+      self.save_m2m()
     return user
     return user
 
 
+class SuperUserChangeForm(UserChangeForm):
+  class Meta(UserChangeForm.Meta):
+    fields = ["username", "is_active"] + UserChangeForm.Meta.fields + ["is_superuser", "groups"]
+
+    def __init__(self, *args, **kwargs):
+      """
+      Set the default for group membership in 'users' group.
+      """
+      super(SuperUserChangeForm, self).__init__(*args, **kwargs)
+      # Note that because of the way the template displays this,
+      # this isn't actually used.  But if it were using
+      # the normal django way, it would be.
+      if not self.instance.id:
+        self.initial["groups"] = []
+
+
 def edit_user(request, username=None):
 def edit_user(request, username=None):
   """
   """
   edit_user(request, username = None) -> reply
   edit_user(request, username = None) -> reply
@@ -151,8 +169,13 @@ def edit_user(request, username=None):
   else:
   else:
     instance = None
     instance = None
 
 
+  if request.user.is_superuser:
+    form_class = SuperUserChangeForm
+  else:
+    form_class = UserChangeForm
+
   if request.method == 'POST':
   if request.method == 'POST':
-    form = UserChangeForm(request.POST, instance=instance)
+    form = form_class(request.POST, instance=instance)
     if form.is_valid(): # All validation rules pass
     if form.is_valid(): # All validation rules pass
       if instance is None:
       if instance is None:
         form.save()
         form.save()
@@ -186,7 +209,7 @@ def edit_user(request, username=None):
       request.path = urlresolvers.reverse(list_users)
       request.path = urlresolvers.reverse(list_users)
       return list_users(request)
       return list_users(request)
   else:
   else:
-    form = UserChangeForm(instance=instance)
+    form = form_class(instance=instance)
   return render('edit_user.mako', request,
   return render('edit_user.mako', request,
     dict(form=form, action=request.path, username=username))
     dict(form=form, action=request.path, username=username))