Skip to content

Commit be49753

Browse files
polobopolobo
committed
Protect actions behind user.is_authenticated
The idea of having actions visible and then redirect for authentication is acceptable in general but the /patch view is now driven by the role of the user viewing the page that it seems easier to simply show no actions if the user is not authenticated and add a note just above the action table indicating the read-only mode. Add missing is_staff protection for the administrative actions form. Just outright removing the key-value table if you are not logged in. Don't want to edit it, want to get rid of it.
1 parent 69138d4 commit be49753

File tree

2 files changed

+153
-125
lines changed

2 files changed

+153
-125
lines changed

‎pgcommitfest/commitfest/templates/patch.html

Lines changed: 18 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,16 @@
11
{%extends "base.html"%}
22
{%load commitfest%}
33
{%block contents%}
4-
{%include "patch_administrative.inc"%}
4+
{%if user.is_staff %}
5+
{%include "patch_administrative.inc"%}
6+
{%endif%}
7+
8+
{%if not user.is_authenticated %}
9+
<div>
10+
Read-Only mode. <a href="/account/login/?next={{request.path}}">Log in</a> to interact with this patch.
11+
</div>
12+
{%endif%}
13+
514
{%include "patch_workflow.inc"%}
615

716
<div class="workflow">
@@ -18,7 +27,9 @@
1827
{%if patch.gitlink%}
1928
<a href="{{patch.gitlink}}">Git</a>
2029
{%endif%}
21-
<a class="btn btn-default pull-right" href="edit/">Edit</a>
30+
{%if user.is_authenticated %}
31+
<a class="btn btn-default pull-right" href="edit/">Edit</a>
32+
{%endif%}
2233
</td>
2334
</tr>
2435
<tr>
@@ -38,7 +49,9 @@
3849

3950
<div>
4051
<button class="btn btn-default" data-toggle="collapse" data-target="#history-table">Toggle History Table</button>
41-
<button class="btn btn-default" data-toggle="collapse" data-target="#keyvalue-table">Toggle Key-Value Table</button>
52+
{%if user.is_authenticated %}
53+
<button class="btn btn-default" data-toggle="collapse" data-target="#keyvalue-table">Toggle Key-Value Table</button>
54+
{%endif%}
4255
</div>
4356

4457
<div id="history-table" class="table table-bordered">
@@ -62,8 +75,9 @@ <h3>History</h3>
6275
</tbody>
6376
</table>
6477
</div>
65-
78+
{%if user.is_authenticated %}
6679
{%include "patch_table_keyvalue.inc"%}
80+
{%endif%}
6781

6882
{%comment%}commit dialog{%endcomment%}
6983
<div class="modal fade" id="commitModal" role="dialog">

‎pgcommitfest/commitfest/templates/patch_workflow.inc

Lines changed: 135 additions & 121 deletions
Original file line numberDiff line numberDiff line change
@@ -1,131 +1,145 @@
11
{%load commitfest%}
22
<div class="workflow">
33
<table class="table table-bordered">
4-
<thead>
5-
<tr>
6-
<th>Assign To</th>
7-
<th>Annotate</th>
8-
<th>Resolve</th>
9-
<th>Move To</th>
10-
</tr>
11-
</thead>
12-
<tbody>
13-
<tr>
14-
<!-- Change -->
15-
<td>
16-
{%if poc.status == poc.STATUS_AUTHOR %}
17-
<a class="btn btn-default" href="status/review/">Reviewer</a>
18-
{%endif%}
19-
{%if poc.status == poc.STATUS_REVIEW or poc.status == poc.STATUS_COMMITTER %}
20-
<a class="btn btn-default" href="status/author/">Author</a>
21-
{%endif%}
22-
{%if poc.status == poc.STATUS_REVIEW %}
23-
<a class="btn btn-default" href="status/committer/">Committer</a>
24-
{%endif%}
25-
</td>
26-
<!-- Annotate -->
27-
<td>
28-
<a class="btn btn-default" href="comment/">Comment</a>
29-
<a class="btn btn-default" href="review/">Review</a>
30-
</td>
31-
<!-- Resolve -->
32-
<td>
33-
{%if is_committer or is_author %}
34-
{%if is_committer %}
35-
<a class="btn btn-default" href="close/committed/" onclick="return flagCommitted({%if patch.committer%}'{{patch.committer}}'{%elif is_committer%}'{{user.username}}'{%else%}null{%endif%})">Commit</a>
36-
<a class="btn btn-default" href="close/reject/" onclick="return verify_reject()">Reject</a>
37-
{%endif%}
38-
{%if is_author %}
39-
<a class="btn btn-default" href="close/withdrawn/" onclick="return verify_withdrawn()">Withdraw</a>
40-
{%endif%}
41-
{%else%}
42-
<span>No Actions Available</span>
43-
{%endif%}
44-
</td>
45-
<!-- Move -->
46-
<td>
47-
{%if not cf.isfuture and workflow.future %}
48-
{%if True %}
49-
<a class="btn btn-default"
50-
href="transition/?fromcfid={{poc.commitfest.id}}&tocfid={{workflow.future.id}}">
51-
{{workflow.future.name}}</a>
52-
{%endif%}
53-
{%endif%}
4+
{%if user.is_authenticated %}
5+
<thead>
6+
<tr>
7+
<th>Assign To</th>
8+
<th>Annotate</th>
9+
<th>Resolve</th>
10+
<th>Move To</th>
11+
</tr>
12+
</thead>
13+
<tbody>
14+
<tr>
15+
<!-- Change -->
16+
<td>
17+
{%if poc.status == poc.STATUS_AUTHOR %}
18+
<a class="btn btn-default" href="status/review/">Reviewer</a>
19+
{%endif%}
20+
{%if poc.status == poc.STATUS_REVIEW or poc.status == poc.STATUS_COMMITTER %}
21+
<a class="btn btn-default" href="status/author/">Author</a>
22+
{%endif%}
23+
{%if poc.status == poc.STATUS_REVIEW %}
24+
<a class="btn btn-default" href="status/committer/">Committer</a>
25+
{%endif%}
26+
</td>
27+
<!-- Annotate -->
28+
<td>
29+
<a class="btn btn-default" href="comment/">Comment</a>
30+
<a class="btn btn-default" href="review/">Review</a>
31+
</td>
32+
<!-- Resolve -->
33+
<td>
34+
{%if is_committer or is_author %}
35+
{%if is_committer %}
36+
<a class="btn btn-default" href="close/committed/" onclick="return flagCommitted({%if patch.committer%}'{{patch.committer}}'{%elif is_committer%}'{{user.username}}'{%else%}null{%endif%})">Commit</a>
37+
<a class="btn btn-default" href="close/reject/" onclick="return verify_reject()">Reject</a>
38+
{%endif%}
39+
{%if is_author %}
40+
<a class="btn btn-default" href="close/withdrawn/" onclick="return verify_withdrawn()">Withdraw</a>
41+
{%endif%}
42+
{%else%}
43+
<span>No Actions Available</span>
44+
{%endif%}
45+
</td>
46+
<!-- Move -->
47+
<td>
48+
{%if not cf.isfuture and workflow.future %}
49+
{%if True %}
50+
<a class="btn btn-default"
51+
href="transition/?fromcfid={{poc.commitfest.id}}&tocfid={{workflow.future.id}}">
52+
{{workflow.future.name}}</a>
53+
{%endif%}
54+
{%endif%}
5455

55-
{%if not cf.isopen and workflow.open %}
56-
{%if is_committer %}
57-
<a class="btn btn-default"
58-
href="transition/?fromcfid={{poc.commitfest.id}}&tocfid={{workflow.open.id}}">
59-
{{workflow.open.name}}</a>
60-
{%endif%}
61-
{%endif%}
56+
{%if not cf.isopen and workflow.open %}
57+
{%if is_committer %}
58+
<a class="btn btn-default"
59+
href="transition/?fromcfid={{poc.commitfest.id}}&tocfid={{workflow.open.id}}">
60+
{{workflow.open.name}}</a>
61+
{%endif%}
62+
{%endif%}
6263

63-
{%if not cf.isinprogress and workflow.progress %}
64-
{%if is_committer %}
65-
<a class="btn btn-default"
66-
href="transition/?fromcfid={{poc.commitfest.id}}&tocfid={{workflow.progress.id}}">
67-
{{workflow.progress.name}}</a>
68-
{%endif%}
69-
{%endif%}
64+
{%if not cf.isinprogress and workflow.progress %}
65+
{%if is_committer %}
66+
<a class="btn btn-default"
67+
href="transition/?fromcfid={{poc.commitfest.id}}&tocfid={{workflow.progress.id}}">
68+
{{workflow.progress.name}}</a>
69+
{%endif%}
70+
{%endif%}
7071

71-
{%if not cf.isparked and workflow.parked %}
72-
{%if is_author %}
73-
<a class="btn btn-default"
74-
href="transition/?fromcfid={{poc.commitfest.id}}&tocfid={{workflow.parked.id}}">
75-
{{workflow.parked.name}}</a>
76-
{%endif%}
77-
{%endif%}
78-
79-
</td>
80-
</tr>
72+
{%if not cf.isparked and workflow.parked %}
73+
{%if is_author %}
74+
<a class="btn btn-default"
75+
href="transition/?fromcfid={{poc.commitfest.id}}&tocfid={{workflow.parked.id}}">
76+
{{workflow.parked.name}}</a>
77+
{%endif%}
78+
{%endif%}
8179

82-
<tr>
83-
<th>Author(s)</th>
84-
<th>Reviewer(s)</th>
85-
<th>Committer</th>
86-
<th>Status</th>
87-
</tr>
88-
89-
<tr>
90-
<!-- Change -->
91-
<td>
92-
{%for author in authors %}
93-
<div>{{author.first_name}} {{author.last_name}}</div>
94-
{%endfor%}
95-
{%if is_author or is_committer %}
96-
<a class="btn btn-default " href="edit/">Edit Authors</a>
97-
{%endif%}
98-
</td>
99-
<!-- Annotate -->
100-
<td>
101-
{%for reviewer in reviewers %}
102-
<div>{{reviewer.first_name}} {{reviewer.last_name}}</div>
103-
{%endfor%}
104-
<div><a href="reviewer/{{is_reviewer|yesno:"remove,become"}}/" class="btn btn-default">{{is_reviewer|yesno:"Remove from reviewers,Become reviewer"}}</a></div>
105-
</td>
106-
<!-- Resolve -->
107-
<td>
108-
{%if patch.committer%}<div>{{patch.committer.fullname}}</div>{%endif%}
109-
{%if is_committer%}<div><a href="committer/{{is_this_committer|yesno:"remove,become"}}/" class="btn btn-default">{{is_this_committer|yesno:"Unclaim as committer,Claim as committer"}}</a></div>{%endif%}
110-
</td>
111-
<!-- Move -->
112-
<td>
113-
<div>
114-
<span class="label label-{{poc.commitfest.status|patchstatuslabel}}">{{poc.commitfest.statusstring}}</span>
115-
<span class="label label-{{poc.status|patchstatuslabel}}">{{poc.statusstring}}</span>
116-
<span><a href="edit/">Version</a>: </span> <span class="label label-default">{%if patch.targetversion%}{{patch.targetversion}}{%else%}N/A{%endif%}</span>
117-
{%if user.is_authenticated%}
118-
<span class="pull-right">Updates: <a href="{{is_subscribed|yesno:"unsubscribe,subscribe"}}/" class="btn btn-default">{{is_subscribed|yesno:"Unsubscribe,Subscribe"}}</a></span>
80+
</td>
81+
</tr>
82+
</tbody>
83+
{%endif%}
84+
<thead>
85+
<tr>
86+
<th>Author(s)</th>
87+
<th>Reviewer(s)</th>
88+
<th>Committer</th>
89+
<th>Status</th>
90+
</tr>
91+
</thead>
92+
<tbody>
93+
<tr>
94+
<!-- Change -->
95+
<td>
96+
{%for author in authors %}
97+
<div>{{author.first_name}} {{author.last_name}}</div>
98+
{%endfor%}
99+
{%if is_author or is_committer %}
100+
<a class="btn btn-default " href="edit/">Edit Authors</a>
101+
{%endif%}
102+
</td>
103+
<!-- Annotate -->
104+
<td>
105+
{%for reviewer in reviewers %}
106+
<div>{{reviewer.first_name}} {{reviewer.last_name}}</div>
107+
{%endfor%}
108+
{%if user.is_authenticated %}
109+
<div><a href="reviewer/{{is_reviewer|yesno:"remove,become"}}/" class="btn btn-default">{{is_reviewer|yesno:"Remove from reviewers,Become reviewer"}}</a></div>
119110
{%endif%}
120-
</div>
121-
<div>
122-
<span><a href="edit/">Topic</a>: </span></span> <span>{{ patch.topic }}</span>
123-
</div>
124-
<div>
125-
<span>Last Modified:</span> <span>{{patch.modified}} ({% cfwhen patch.modified %})</span>
126-
</div>
127-
</td>
128-
</tr>
129-
</tbody>
111+
</td>
112+
<!-- Resolve -->
113+
<td>
114+
{%if patch.committer%}<div>{{patch.committer.fullname}}</div>{%endif%}
115+
{%if is_committer%}<div><a href="committer/{{is_this_committer|yesno:"remove,become"}}/" class="btn btn-default">{{is_this_committer|yesno:"Unclaim as committer,Claim as committer"}}</a></div>{%endif%}
116+
</td>
117+
<!-- Move -->
118+
<td>
119+
<div>
120+
<span class="label label-{{poc.commitfest.status|patchstatuslabel}}">{{poc.commitfest.statusstring}}</span>
121+
<span class="label label-{{poc.status|patchstatuslabel}}">{{poc.statusstring}}</span>
122+
<span>
123+
{%if user.is_authenticated%}<a href="edit/">{%endif%}
124+
Version{%if user.is_authenticated%}</a>{%endif%}:
125+
</span>
126+
<span class="label label-default">{%if patch.targetversion%}{{patch.targetversion}}{%else%}N/A{%endif%}</span>
127+
{%if user.is_authenticated %}
128+
<span class="pull-right">Updates: <a href="{{is_subscribed|yesno:"unsubscribe,subscribe"}}/" class="btn btn-default">{{is_subscribed|yesno:"Unsubscribe,Subscribe"}}</a></span>
129+
{%endif%}
130+
</div>
131+
<div>
132+
<span>
133+
{%if user.is_authenticated%}<a href="edit/">{%endif%}
134+
Topic{%if user.is_authenticated%}</a>{%endif%}:
135+
</span>
136+
<span>{{ patch.topic }}</span>
137+
</div>
138+
<div>
139+
<span>Last Modified:</span> <span>{{patch.modified}} ({% cfwhen patch.modified %})</span>
140+
</div>
141+
</td>
142+
</tr>
143+
</tbody>
130144
</table>
131145
</div>

0 commit comments

Comments
 (0)