ynerant/plateforme-corres2math
1
0
Fork 0
mirror of https://gitlab.com/animath/si/plateforme-corres2math.git synced 2024-12-05 02:06:52 +00:00
Code Issues Releases Wiki Activity

Prevent errors when a not authenticated user tries to see a user detail page

Browse Source
This commit is contained in:
Yohann D'ANELLO 2020-12-11 11:33:12 +01:00
parent 55a727612c
commit 833f9147ce
2 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
apps/registration/tests.py
View File

@ -31,6 +31,10 @@ class TestIndexPage(TestCase):
response = self.client.get(reverse("registration:reset_admin")) response = self.client.get(reverse("registration:reset_admin"))
self.assertRedirects(response, reverse("login") + "?next=" + reverse("registration:reset_admin"), 302, 200) self.assertRedirects(response, reverse("login") + "?next=" + reverse("registration:reset_admin"), 302, 200)
User.objects.create()
response = self.client.get(reverse("registration:user_detail", args=(1,)))
self.assertRedirects(response, reverse("login") + "?next=" + reverse("registration:user_detail", args=(1,)))
class TestRegistration(TestCase): class TestRegistration(TestCase):
def setUp(self) -> None: def setUp(self) -> None:

2
apps/registration/views.py
View File

@ -158,6 +158,8 @@ class UserDetailView(LoginRequiredMixin, DetailView):
def dispatch(self, request, *args, **kwargs): def dispatch(self, request, *args, **kwargs):
user = request.user user = request.user
if not user.is_authenticated:
return self.handle_no_permission()
# Only an admin or the concerned user can see the information # Only an admin or the concerned user can see the information
if not user.registration.is_admin and user.pk != kwargs["pk"]: if not user.registration.is_admin and user.pk != kwargs["pk"]:
raise PermissionDenied raise PermissionDenied