Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix permissions for the Pages section of the admin console. Closes #2060. #2140

Merged
merged 1 commit into from
Nov 28, 2023

Conversation

tompollard
Copy link
Member

As discussed in #2060, there is a bug the "Pages" permissions. Currently, it is not possible to assign users the correct permissions to view the Pages tabs in the console.

Screenshot 2023-11-28 at 3 12 41 PM

There are two issues:

  1. The navbar HTML template is looking for user.change_staticpage and user.change_frontpagebutton permissions, which don't exist. These permissions belong to the physionet app, not users.
  2. The view_redirects view is restricting access to a physionet.view_redirect permission, which doesn't exist. The redirect permission belongs to Django's redirects app.

Side note, but it isn't ideal that the navbar logic displays all three subitems {% if perms.physionet.change_staticpage or perms.physionet.change_frontpagebutton or perms.redirect.view_redirect %}, even if the user only has permission to view/edit one of the subitems. I think we can worry about this later.

It might be cleaner to display all tabs/pages admin users, even if the user doesn't have permission to edit/view the page. This way the user knows what functionality exists, and they can request access if needed.

@bemoody
Copy link
Collaborator

bemoody commented Nov 28, 2023

The view_redirects view is restricting access to a physionet.view_redirect permission, which doesn't exist. The redirect permission belongs to Django's redirects app.

It seems like our test suite should have caught this; probably it didn't because admin is a "superuser" and therefore is assumed to have all permissions, even those that don't exist. :/

@bemoody bemoody merged commit af2b64a into dev Nov 28, 2023
11 checks passed
@tompollard tompollard deleted the tp/pages_permission branch November 29, 2023 02:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants