Merge pull request #1534 from ae-utbm/preference-perm

fix: permission check on `UserVisibilityFormFragment`

core/tests/test_user.py

@@ -472,6 +472,36 @@ def test_user_preferences(client: Client):
     assert user.preferences.notify_on_click is True
 
 
+@pytest.mark.django_db
+@pytest.mark.parametrize("can_edit", [True, False])
+def test_user_visibility(client: Client, monkeypatch, can_edit):
+    # The view is a CanView, so just patch User.can_be_edited_by for the test
+    monkeypatch.setattr("core.models.User.can_be_edited_by", lambda *args: can_edit)
+    client.force_login(subscriber_user.make())
+
+    user, other_user = subscriber_user.make(_quantity=2)
+    url = reverse("core:user_visibility_fragment", kwargs={"user_id": user.id})
+    response = client.get(url)
+    assert response.status_code == 200 if can_edit else 403
+    response = client.post(
+        url,
+        {
+            "show_my_stats": False,
+            "is_viewable": False,
+            "whitelisted_users": [other_user.id],
+        },
+    )
+    if not can_edit:
+        assert response.status_code == 403
+        return
+    assertRedirects(response, url)
+    user.refresh_from_db()
+    user.preferences.refresh_from_db()
+    assert user.is_viewable is False
+    assert list(user.whitelisted_users.all()) == [other_user]
+    assert user.preferences.show_my_stats is False
+
+
 @pytest.mark.django_db
 def test_user_stats(client: Client):
     user = subscriber_user.make()

core/views/mixins.py

@@ -94,8 +94,8 @@ class FragmentMixin(TemplateResponseMixin, AllowFragment, ContextMixin):
             return render(
                 request,
                 "app/template.jinja",
-                context={"fragment": fragment(request)
+                context={"fragment": fragment(request)}
-            }
+            )
 
         # in urls.py
         urlpatterns = [

core/views/user.py

@@ -502,7 +502,9 @@ class UserClubView(UserTabsMixin, CanViewMixin, DetailView):
     current_tab = "clubs"
 
 
-class UserVisibilityFormFragment(FragmentMixin, SuccessMessageMixin, UpdateView):
+class UserVisibilityFormFragment(
+    FragmentMixin, SuccessMessageMixin, CanEditMixin, UpdateView
+):
     model = User
     form_class = UserVisibilityForm
     template_name = "core/fragment/user_visibility.jinja"