External-Mirrors/awx
2
0
Fork 0
mirror of https://github.com/ansible/awx.git synced 2026-03-01 00:38:45 -03:30
Code Issues Packages Projects Releases Wiki Activity

do not allow membership changes to User.admin_role

Browse Source
This commit is contained in:
Wayne Witzel III
2016-07-28 19:26:30 -04:00
parent a078254508
commit 06bb8871d7
2 changed files with 16 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
awx/api/views.py
View File

@@ -1208,7 +1208,12 @@ class UserRolesList(SubListCreateAttachDetachAPIView):
return Response(data, status=status.HTTP_400_BAD_REQUEST) return Response(data, status=status.HTTP_400_BAD_REQUEST)
if sub_id == self.request.user.admin_role.pk: if sub_id == self.request.user.admin_role.pk:
raise PermissionDenied('You may not remove your own admin_role.') raise PermissionDenied('You may not perform any action with your own admin_role.')
role = get_object_or_404(Role, pk=sub_id)
user_content_type = ContentType.objects.get_for_model(User)
if role.content_type == user_content_type:
raise PermissionDenied('You may not change the membership of a users admin_role')
return super(UserRolesList, self).post(request, *args, **kwargs) return super(UserRolesList, self).post(request, *args, **kwargs)

10
awx/main/tests/functional/api/test_user.py
View File

@@ -66,3 +66,13 @@ def test_create_delete_create_user(post, delete, admin):
}, admin) }, admin)
print(response.data) print(response.data)
assert response.status_code == 201 assert response.status_code == 201
@pytest.mark.django_db
def test_add_user_admin_role_member(post, user):
admin = user('admin', is_superuser=True)
normal = user('normal')
url = reverse('api:user_roles_list', args=(admin.pk,))
response = post(url, {'id':normal.admin_role.pk}, admin)
assert response.status_code == 403
assert 'not change membership' in response.rendered_content