Zareian
28b8527760
- accounts admin: phone/is_guest read-only for non-superusers, device_id filter lookups refused, auth.User/Group admin writable only by superusers - campaigns: delivery log needs view permission - phone/OTP/birth date: any Unicode digit normalised or rejected with 400; unknown gradeId is 400 - shared demo guest is never turned into a person's account by logging in - /api/home with unknown gradeId is no longer cached (LocMemCache flood reset throttle counters) - /api/progress/nodes: one query, huge unit is 400 - BazaarCredential token filter lookups refused Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
31 lines
1.6 KiB
Python
31 lines
1.6 KiB
Python
"""
|
|
حفاظهای بازبینیِ امنیتی (کمپینها در پنل).
|
|
"""
|
|
from django.contrib.auth import get_user_model
|
|
from django.contrib.auth.models import Permission
|
|
from django.test import TestCase
|
|
|
|
from .models import CampaignDelivery, MessageCampaign
|
|
|
|
|
|
class CampaignDeliveryNeedsViewPermissionTests(TestCase):
|
|
"""لاگِ تحویلِ کمپین (user_id، متنِ خطای ارسال) فقط با view_campaigndelivery دیده میشود، نه برای هر کارمند."""
|
|
|
|
def setUp(self):
|
|
campaign = MessageCampaign.objects.create(title='t', body='b', channel='sms')
|
|
self.delivery = CampaignDelivery.objects.create(campaign=campaign, user_id=5, channel='sms',
|
|
status='failed', error_message='e')
|
|
self.staff = get_user_model().objects.create_user('st', 'st@example.com', 'pw-for-tests-only', is_staff=True)
|
|
self.client.force_login(self.staff)
|
|
|
|
def test_staff_without_permission_gets_403(self):
|
|
self.assertEqual(self.client.get('/admin/campaigns/campaigndelivery/').status_code, 403)
|
|
self.assertEqual(
|
|
self.client.get(f'/admin/campaigns/campaigndelivery/{self.delivery.pk}/change/').status_code, 403)
|
|
|
|
def test_view_permission_still_read_only(self):
|
|
self.staff.user_permissions.add(
|
|
Permission.objects.get(content_type__app_label='campaigns', codename='view_campaigndelivery'))
|
|
self.assertEqual(self.client.get('/admin/campaigns/campaigndelivery/').status_code, 200)
|
|
self.assertEqual(self.client.get('/admin/campaigns/campaigndelivery/add/').status_code, 403)
|