Read-only users cannot edit filtering rules.

hc/front/tests/test_details.py

@@ -55,5 +55,6 @@ class DetailsTestCase(BaseTestCase):
 
         self.assertNotContains(r, "edit-name", status_code=200)
         self.assertNotContains(r, "edit-desc")
+        self.assertNotContains(r, "Filtering Rules")
         self.assertNotContains(r, "pause-btn")
         self.assertNotContains(r, "Change Schedule")

hc/front/tests/test_filtering_rules.py

@@ -20,7 +20,7 @@ class FilteringRulesTestCase(BaseTestCase):
         }
 
         self.client.login(username="alice@example.org", password="password")
-        r = self.client.post(self.url, data=payload,)
+        r = self.client.post(self.url, data=payload)
         self.assertRedirects(r, self.redirect_url)
 
         self.check.refresh_from_db()
@@ -72,3 +72,19 @@ class FilteringRulesTestCase(BaseTestCase):
 
         self.check.refresh_from_db()
         self.assertFalse(self.check.manual_resume)
+
+    def test_it_requires_rw_access(self):
+        self.bobs_membership.rw = False
+        self.bobs_membership.save()
+
+        payload = {
+            "subject": "SUCCESS",
+            "subject_fail": "ERROR",
+            "methods": "POST",
+            "manual_resume": "1",
+            "filter_by_subject": "yes",
+        }
+
+        self.client.login(username="bob@example.org", password="password")
+        r = self.client.post(self.url, payload)
+        self.assertEqual(r.status_code, 403)

hc/front/views.py

@@ -362,6 +362,9 @@ def update_name(request, code):
 @login_required
 def filtering_rules(request, code):
     check, rw = _get_check_for_user(request, code)
+    if not rw:
+        return HttpResponseForbidden()
+
     form = forms.FilteringRulesForm(request.POST)
     if form.is_valid():
         check.subject = form.cleaned_data["subject"]

templates/front/details.html

@@ -95,10 +95,12 @@
                 </p>
             </div>
             <div class="text-right">
+                {% if rw %}
                 <button
                     data-toggle="modal"
                     data-target="#filtering-rules-modal"
                     class="btn btn-sm btn-default">Filtering Rules&hellip;</button>
+                {% endif %}
                 <button
                     data-toggle="modal"
                     data-target="#show-usage-modal"