10000 Fixed a bug where non-staff user would be able to open empty structur… · django-cms/django-cms@917d768 · GitHub
[go: up one dir, main page]
Skip to content

Commit 917d768

Browse files
vxsxvxsx
committed
Fixed a bug where non-staff user would be able to open empty structure board
1 parent b50dd70 commit 917d768

File tree

5 files changed

+95
-2
lines changed

5 files changed

+95
-2
lines changed

‎CHANGELOG.txt

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@
55
opened with blank page
66
* Fixed a bug where the direct children of the homepage would get a leading ``/``
77
character when the homepage was moved or published.
8+
* Fixed a bug where non-staff user would be able to open empty structure board
89

910

1011
=== 3.5.1 (2018-03-05) ===

‎cms/templates/cms/toolbar/toolbar_javascript.html

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -112,7 +112,7 @@
112112
'settings': {
113113
'version': '{{ cms_version }}',
114114
'toolbar': 'expanded',
115-
'mode': {% if cms_toolbar.content_mode_active %}'edit'{% else %}'structure'{% endif %},
115+
'mode': {% if cms_toolbar.structure_mode_active %}'structure'{% else %}'edit'{% endif %},
116116
'sideframe': { 'url': '' },
117117
'states': [],
118118
'edit': '{{ cms_edit_on }}',

‎cms/tests/frontend/integration/nonadmin.js

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
'use strict';
2+
3+
var helpers = require('djangocms-casper-helpers');
4+
var globals = helpers.settings;
5+
var casperjs = require('casper');
6+
var xPath = casperjs.selectXPath;
7+
var cms = helpers(casperjs);
8+
9+
casper.test.setUp(function(done) {
10+
casper
11+
.start()
12+
.then(cms.login())
13+
.then(cms.addPage({ title: 'Home page' }))
14+
.then(
15+
cms.addPlugin({
16+
type: 'TextPlugin',
17+
content: {
18+
id_body: 'Random text'
19+
}
20+
})
21+
)
22+
.then(cms.publishPage({ page: 'Home page', language: 'en' }))
23+
.run(done);
24+
});
25+
26+
casper.test.tearDown(function(done) {
27+
casper.start().then(cms.login()).then(cms.removePage()).then(cms.logout()).run(done);
28+
});
29+
30+
casper.test.begin('Non admin user cannot open structureboard', function(test) {
31+
casper
32+
.start()
33+
.then(cms.logout())
34+
.then(
35+
cms.login({
36+
username: 'normal',
37+
password: 'normal'
38+
})
39+
)
40+
.thenOpen(globals.editUrl)
41+
.waitForSelector('.cms-ready', function() {
42+
this.mouse.doubleclick(
43+
// pick a div with class cms-plugin that has a p that has text "Random text"
44+
xPath('//*[contains(@class, "cms-plugin")][contains(text(), "Random text")]')
45+
);
46+
})
47+
.waitUntilVisible('.cms-modal-open')
48+
.withFrame(0, function() {
49+
casper.waitUntilVisible('body', function() {
50+
test.assertSelectorHasText('body', 'You do not have permission to edit this plugin');
51+
});
52+
})
53+
.then(function() {
54+
this.click('.cms-modal-open .cms-modal-item-buttons:last-child > a');
55+
})
56+
.waitWhileVisible('.cms-modal-iframe')
57+
.then(function() {
58+
// normally nothing happens on click, but we are making sure there are no regressions
59+
this.mouse.click(
60+
// pick a div with class cms-plugin that has a p that has text "Random text"
61+
xPath('//*[contains(@class, "cms-plugin")][contains(text(), "Random text")]')
62+
);
63+
})
64+
.then(function() {
65+
test.assertSelectorDoesntHaveText('.cms-structure', 'Placeholder_Content_1');
66+
})
67+
.then(function() {
68+
this.evaluate(function() {
69+
CMS.$(document).data('expandmode', true);
70+
});
71+
// normally nothing happens on click, but we are making sure there are no regressions
72+
this.mouse.click(
73+
// pick a div with class cms-plugin that has a p that has text "Random text"
74+
xPath('//*[contains(@class, "cms-plugin")][contains(text(), "Random text")]')
75+
);
76+
})
77+
.then(function() {
78+
test.assertSelectorDoesntHaveText('.cms-structure', 'Placeholder_Content_1');
79+
})
80+
.wait(3000, function() {
81+
test.assertSelectorDoesntHaveText('.cms-structure', 'Placeholder_Content_1');
82+
})
83+
.then(cms.logout())
84+
.run(function() {
85+
test.done();
86+
});
87+
});

‎gulpfile.js

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -99,7 +99,8 @@ var INTEGRATION_TESTS = [
9999
'dragndrop',
100100
'copy-apphook-page',
101101
// 'revertLive', // disabled
102-
'narrowScreen'
102+
'narrowScreen',
103+
'nonadmin'
103104
]
104105
];
105106

‎testserver.py

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -152,7 +152,11 @@ def update(self, whatever):
152152

153153
def _helper_patch(*args, **kwargs):
154154
from django.core.management import call_command
155+
from djangocms_helper import utils
156+
155157
call_command('migrate', run_syncdb=True)
158+
utils.create_user('normal', 'normal@normal.normal', 'normal', is_staff=True, base_cms_permissions=True,
159+
permissions=['view_page'])
156160

157161

158162
def run():

0 commit comments

Comments
 (0)
0