mirror of
https://github.com/retspen/webvirtcloud
synced 2026-11-08 11:16:47 +00:00
385a332197
change_options set is_template for any owner with is_change; the "staff only" rule existed only as a disabled checkbox in the UI. A non-staff owner could mark or unmark templates with a POST, and because a disabled checkbox is not submitted, a non-staff owner who only edited a template's title or description silently unmarked it, which lifted the template-only restrictions. Only change is_template for superusers and staff (for them an unchecked, unsubmitted checkbox still means "not a template"); leave it alone for everyone else.
71 lines
2.9 KiB
Python
71 lines
2.9 KiB
Python
"""
|
|
ROADMAP S-22: only superusers and staff may mark or unmark a VM as a template.
|
|
The UI only disables the checkbox for other users, and a disabled checkbox is
|
|
not submitted, so the server must not derive is_template from its absence for
|
|
them.
|
|
"""
|
|
from unittest.mock import patch
|
|
|
|
from django.contrib.auth import get_user_model
|
|
from django.test import TestCase
|
|
from django.urls import reverse
|
|
|
|
from accounts.models import UserInstance
|
|
from computes.models import Compute
|
|
from instances.models import Instance
|
|
|
|
|
|
class TemplateFlagTestCase(TestCase):
|
|
def setUp(self):
|
|
User = get_user_model()
|
|
self.superuser = User.objects.create_superuser(
|
|
username="tpl_super", email="tpl_super@example.com", password="x"
|
|
)
|
|
self.owner = User.objects.create_user(username="tpl_owner", password="x")
|
|
self.staff_owner = User.objects.create_user(
|
|
username="tpl_staff_owner", password="x", is_staff=True
|
|
)
|
|
self.compute = Compute.objects.create(
|
|
name="tpl-compute", hostname="127.0.0.1:1", login="root", password="", type=1
|
|
)
|
|
self.instance = Instance.objects.create(
|
|
compute=self.compute,
|
|
name="tpl-vm",
|
|
uuid="dddddddd-eeee-ffff-0000-111111111111",
|
|
)
|
|
for user in (self.owner, self.staff_owner):
|
|
UserInstance.objects.create(instance=self.instance, user=user, is_change=True)
|
|
|
|
def _change_options(self, user, data):
|
|
self.client.force_login(user)
|
|
with patch("instances.models.wvmInstance"):
|
|
res = self.client.post(
|
|
reverse("instances:change_options", args=[self.instance.id]), data
|
|
)
|
|
self.assertEqual(res.status_code, 302)
|
|
self.instance.refresh_from_db()
|
|
|
|
def _make_template(self):
|
|
self.instance.is_template = True
|
|
self.instance.save(update_fields=["is_template"])
|
|
|
|
def test_owner_cannot_mark_vm_as_template(self):
|
|
self._change_options(self.owner, {"title": "t", "is_template": "True"})
|
|
self.assertFalse(self.instance.is_template)
|
|
|
|
def test_owner_editing_title_does_not_unmark_template(self):
|
|
self._make_template()
|
|
self._change_options(self.owner, {"title": "new title", "description": ""})
|
|
self.assertTrue(self.instance.is_template)
|
|
|
|
def test_staff_owner_can_mark_and_unmark_template(self):
|
|
self._change_options(self.staff_owner, {"title": "t", "is_template": "True"})
|
|
self.assertTrue(self.instance.is_template)
|
|
# An unchecked checkbox is not submitted: for staff that means "not a template".
|
|
self._change_options(self.staff_owner, {"title": "t"})
|
|
self.assertFalse(self.instance.is_template)
|
|
|
|
def test_superuser_can_unmark_template(self):
|
|
self._make_template()
|
|
self._change_options(self.superuser, {"title": "t"})
|
|
self.assertFalse(self.instance.is_template)
|