Andal.LND/edx-platform
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Move library creator checks to POST-only

Browse Source
This commit is contained in:
Eric Fischer
2017-11-29 16:11:27 -05:00
parent cb463c0d11
commit a09866622d
2 changed files with 16 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
cms/djangoapps/contentstore/views/library.py
View File

@@ -72,21 +72,20 @@ def library_handler(request, library_key_string=None):
log.exception("Attempted to use the content library API when the libraries feature is disabled.") log.exception("Attempted to use the content library API when the libraries feature is disabled.")
raise Http404 # Should never happen because we test the feature in urls.py also raise Http404 # Should never happen because we test the feature in urls.py also
if not get_library_creator_status(request.user): if request.method == 'POST':
if not request.user.is_staff: if not get_library_creator_status(request.user):
return HttpResponseForbidden() return HttpResponseForbidden()
if library_key_string is not None and request.method == 'POST': if library_key_string is not None:
return HttpResponseNotAllowed(("POST",)) return HttpResponseNotAllowed(("POST",))
if request.method == 'POST':
return _create_library(request) return _create_library(request)
# request method is get, since only GET and POST are allowed by @require_http_methods(('GET', 'POST')) else:
if library_key_string: if library_key_string:
return _display_library(library_key_string, request) return _display_library(library_key_string, request)
return _list_libraries(request) return _list_libraries(request)
def _display_library(library_key_string, request): def _display_library(library_key_string, request):

10
cms/djangoapps/contentstore/views/tests/test_library.py
View File

@@ -72,8 +72,14 @@ class UnitTestLibraries(CourseTestCase):
""" """
nostaff_client, nostaff_user = self.create_non_staff_authed_user_client() nostaff_client, nostaff_user = self.create_non_staff_authed_user_client()
self.assertFalse(get_library_creator_status(nostaff_user)) self.assertFalse(get_library_creator_status(nostaff_user))
response = nostaff_client.get_json(LIBRARY_REST_URL)
self.assertEqual(response.status_code, 200) # To be explicit, this user can GET, but not POST
get_response = nostaff_client.get_json(LIBRARY_REST_URL)
post_response = nostaff_client.ajax_post(LIBRARY_REST_URL, {
'org': 'org', 'library': 'lib', 'display_name': "New Library",
})
self.assertEqual(get_response.status_code, 200)
self.assertEqual(post_response.status_code, 403)
@patch("contentstore.views.library.LIBRARIES_ENABLED", False) @patch("contentstore.views.library.LIBRARIES_ENABLED", False)
def test_with_libraries_disabled(self): def test_with_libraries_disabled(self):