Prevent errors when a not authenticated user tries to see a user detail page

This commit is contained in:
Yohann D'ANELLO 2020-12-11 11:33:12 +01:00
parent 55a727612c
commit 833f9147ce
2 changed files with 6 additions and 0 deletions

View File

@ -31,6 +31,10 @@ class TestIndexPage(TestCase):
response = self.client.get(reverse("registration:reset_admin"))
self.assertRedirects(response, reverse("login") + "?next=" + reverse("registration:reset_admin"), 302, 200)
User.objects.create()
response = self.client.get(reverse("registration:user_detail", args=(1,)))
self.assertRedirects(response, reverse("login") + "?next=" + reverse("registration:user_detail", args=(1,)))
class TestRegistration(TestCase):
def setUp(self) -> None:

View File

@ -158,6 +158,8 @@ class UserDetailView(LoginRequiredMixin, DetailView):
def dispatch(self, request, *args, **kwargs):
user = request.user
if not user.is_authenticated:
return self.handle_no_permission()
# Only an admin or the concerned user can see the information
if not user.registration.is_admin and user.pk != kwargs["pk"]:
raise PermissionDenied