mirror of
https://github.com/retspen/webvirtcloud
synced 2026-11-08 19:26:48 +00:00
6523fd0955
The create and edit pages of a user had one form for both, ordered for editing: permissions first, the name and password folded below them and the quota folded and closed at the end; a new user's name came last. Both pages now go Account (name, password, may sign in), Role, Quota, then Groups and permissions, each section with what it is for beside its fields. Template editor and Superuser become one Role choice with User: choosing Superuser hides the quota and permissions, which a superuser does not need (no quota check applies, every permission is theirs); it keeps the is_staff it had. The quota is always open: each limit takes a number from 0, or No limit, which is kept as -1 as before; memory is entered in GiB and kept in MiB, shown exactly so saving a user again changes nothing. The button says Create user or Save changes.
26 lines
1.2 KiB
Python
26 lines
1.2 KiB
Python
"""After saving a user, the edit page goes back to ?next= only on this site."""
|
|
|
|
from django.contrib.auth.models import User
|
|
from django.test import TestCase
|
|
from django.urls import reverse
|
|
|
|
LIMITS = {"role": "user", "max_instances": 1, "max_cpus": 1, "max_memory": 1, "max_disk_size": 4}
|
|
|
|
|
|
class UserUpdateNextTests(TestCase):
|
|
def setUp(self):
|
|
self.client.force_login(User.objects.create_superuser("un-admin", "un@example.com", "pw"))
|
|
self.user = User.objects.create_user("un-user", password="pw")
|
|
|
|
def save(self, next_url):
|
|
url = reverse("admin:user_update", args=[self.user.id]) + "?next=" + next_url
|
|
return self.client.post(url, {"username": "un-user", "is_active": "on", **LIMITS})
|
|
|
|
def test_a_page_of_this_site(self):
|
|
account = reverse("accounts:account", args=[self.user.id])
|
|
self.assertRedirects(self.save(account), account, fetch_redirect_response=False)
|
|
|
|
def test_another_site_is_not_followed(self):
|
|
for next_url in ("https://evil.example/", "//evil.example/", "/\\evil.example/"):
|
|
with self.subTest(next_url=next_url):
|
|
self.assertRedirects(self.save(next_url), reverse("admin:user_list"), fetch_redirect_response=False)
|