harmacist/healthchecks
1
0
Fork 0
forked from GithubBackups/healthchecks
Code Issues Pull Requests Projects Releases Wiki Activity

/switch_team/ requires login and a valid target username

Browse Source
This commit is contained in:
Pēteris Caune 2016-12-21 18:05:55 +02:00
parent 52cd2a9c8e
commit a412f05651
2 changed files with 19 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
hc/accounts/tests/test_switch_team.py
View File

@ -28,3 +28,17 @@ class SwitchTeamTestCase(BaseTestCase):
url = "/accounts/switch_team/%s/" % self.alice.username url = "/accounts/switch_team/%s/" % self.alice.username
r = self.client.get(url, follow=True) r = self.client.get(url, follow=True)
self.assertEqual(r.status_code, 200) self.assertEqual(r.status_code, 200)
def test_it_handles_invalid_username(self):
self.client.login(username="bob@example.org", password="password")
url = "/accounts/switch_team/dave/"
r = self.client.get(url)
self.assertEqual(r.status_code, 403)
def test_it_requires_login(self):
url = "/accounts/switch_team/%s/" % self.alice.username
r = self.client.get(url)
expected_url = "/accounts/login/?next=/accounts/switch_team/alice/"
self.assertRedirects(r, expected_url)

4
hc/accounts/views.py
View File

@ -266,8 +266,12 @@ def unsubscribe_reports(request, username):
return render(request, "accounts/unsubscribed.html") return render(request, "accounts/unsubscribed.html")
@login_required
def switch_team(request, target_username): def switch_team(request, target_username):
try:
other_user = User.objects.get(username=target_username) other_user = User.objects.get(username=target_username)
except User.DoesNotExist:
return HttpResponseForbidden()
# The rules: # The rules:
# Superuser can switch to any team. # Superuser can switch to any team.