Add check if user has permission to add a project to a profile. #1385
Conversation
|
is there an issue this is tied to? |
|
@pld I believe this is tied to https://github.com/onaio/core/issues/1357 |
| @@ -0,0 +1,55 @@ | |||
| # -*- coding: utf-8 -*- | |||
| """ | |||
| Command apply_can_add_preject_perms - applys can_add_project permission to all | |||
|
|
||
| class Command(BaseCommand): | ||
| """ | ||
| Command apply_can_add_preject_perms - applys can_add_project permission to |
| PROJ_BASE_FORMS_CACHE, PROJ_FORMS_CACHE, PROJ_NUM_DATASET_CACHE, | ||
| PROJ_PERM_CACHE, PROJ_SUB_DATE_CACHE, PROJ_TEAM_USERS_CACHE, | ||
| PROJECT_LINKED_DATAVIEWS, safe_delete) | ||
| from onadata.libs.utils.decorators import check_obj | ||
|
|
||
|
|
||
| def get_obj_xforms(obj): |
There was a problem hiding this comment.
I don't remember if there's a historical reason why we have obj throughout this namespace, but it looks like a future refactor would be to change that to project
There was a problem hiding this comment.
Migration from being in the serializer which expects obj to being a function outside of the serializer, this are the remnants.
| ).first() | ||
| if md and hasattr(md, 'data_value') and md.data_value: | ||
| return True | ||
| fields = ('name', 'formid', 'id_string', 'num_of_submissions', |
|
@ukanga would we need the same kind of fix for XForms? |
|
Does the same kind of error exist for XForm? |
@pld are you talking about this test? |
|
No, since that's tests for moving a project. Replicating the error would be on creating a project in another users account. |
Command apply_can_add_project_perms - applies can_add_project permission to all users who have can_add_xform permission to a user/organization profile. This was necessary because we previously, before April 2018, did not have can_add_project permission on the UserProfile and OrganizationProfile classes. An attempt on doing this in migrations seems not to be a recommended approach.
ukanga
force-pushed
the
project-owner-check
branch
from
387212f to
caa1b54
Compare
@moshthepitt no, when using the projects endpoint the user needs to be a manager of the project. On the forms endpoint there is an explicit check if a user has 'can_add_xform'. On the xforms front this is not an issue. |
|
nearly green, let's merge, get it in next release |
No description provided.