rafaelcaricio/moviewyrm
1
0
Fork 0
forked from mirrors/bookwyrm
Code Issues 4 Pull requests Projects Releases Wiki Activity

don't allow non-manager to add and remove group members

Browse source
This commit is contained in:
Hugh Rundle 2021-09-25 20:25:30 +10:00
parent 035fc5209d
commit ec0720514e
2 changed files with 6 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
bookwyrm/templates/snippets/add_to_group_button.html
View file

@ -1,5 +1,5 @@
{% load i18n %} {% load i18n %}
{% if request.user == user or not request.user.is_authenticated %} {% if request.user == user or not request.user == group.manager or not request.user.is_authenticated %}
<!-- TODO: blocking is irrelevant here, but ...is it? --> <!-- TODO: blocking is irrelevant here, but ...is it? -->
{% elif user in request.user.blocks.all %} {% elif user in request.user.blocks.all %}
{% include 'snippets/block_button.html' with blocks=True %} {% include 'snippets/block_button.html' with blocks=True %}

9
bookwyrm/views/group.py
View file

@ -47,7 +47,7 @@ class UserGroups(View):
data = { data = {
"user": user, "user": user,
"is_self": request.user.id == user.id, "is_self": request.user.id == user.id, # CHECK is this relevant here?
"groups": paginated.get_page(request.GET.get("page")), "groups": paginated.get_page(request.GET.get("page")),
"group_form": forms.GroupForm(), "group_form": forms.GroupForm(),
"path": user.local_path + "/group", "path": user.local_path + "/group",
@ -82,9 +82,12 @@ class FindUsers(View):
request.user request.user
) )
group = get_object_or_404(models.Group, id=group_id)
data["suggested_users"] = user_results data["suggested_users"] = user_results
data["group"] = get_object_or_404(models.Group, id=group_id) data["group"] = group
data["query"] = query data["query"] = query
data["requestor_is_manager"] = request.user == group.manager
return TemplateResponse(request, "groups/find_users.html", data) return TemplateResponse(request, "groups/find_users.html", data)
@login_required @login_required
@ -129,7 +132,6 @@ def add_member(request):
print("no integrity") print("no integrity")
pass pass
# TODO: how do we return and update AJAX data?
return redirect(user.local_path) return redirect(user.local_path)
@require_POST @require_POST
@ -158,5 +160,4 @@ def remove_member(request):
print("no integrity") print("no integrity")
pass pass
# TODO: how do we return and update AJAX data?
return redirect(user.local_path) return redirect(user.local_path)