def test_can_see_root_folder(rf, admin_user):
assert not can_see_root_folder(None)
assert can_see_root_folder(admin_user)
shop = factories.get_default_shop()
staff_user = factories.UserFactory(is_staff=True)
assert not can_see_root_folder(staff_user)
permission_group = factories.get_default_permission_group()
staff_user.groups.add(permission_group)
shop.staff_members.add(staff_user)
set_permissions_for_group(permission_group, ["media.view-all"])
assert can_see_root_folder(staff_user)
def test_media_view_images_without_root_access(rf):
shop = factories.get_default_shop()
staff_user = factories.UserFactory(is_staff=True)
permission_group = factories.get_default_permission_group()
staff_user.groups.add(permission_group)
shop.staff_members.add(staff_user)
set_permissions_for_group(permission_group, ["upload-media"])
assert not can_see_root_folder(staff_user)
folder = get_or_create_folder(shop, "Root")
File.objects.create(name="normalfile", folder=folder)
img = Image.objects.create(name="imagefile", folder=folder, is_public=True)
request = apply_request_middleware(rf.get("/", {
"filter": "images",
"action": "folder"
}),
user=staff_user)
request.user = staff_user
view_func = MediaBrowserView.as_view()
response = view_func(request)
assert isinstance(response, JsonResponse)
content = json.loads(response.content.decode("utf-8"))
assert len(content["folder"]["folders"]) == 0
assert len(content["folder"]["files"]) == 0
def handle_get_folder(self, data):
shop = get_shop(self.request)
try:
folder_id = int(data.get("id", 0))
if folder_id:
folder = _get_folder_query(shop, self.user).get(pk=folder_id)
subfolders = folder.get_children().filter(
_get_folder_query_filter(shop, self.user))
files = _get_file_query(shop, folder)
else:
folder = None
if can_see_root_folder(self.request.user):
subfolders = _get_folder_query(
shop, self.user).filter(parent=None)
files = _get_file_query(shop).filter(folder=None)
else:
files = File.objects.none()
subfolders = Folder.objects.none()
except ObjectDoesNotExist:
return JsonResponse({
"folder": None,
"error": "Error! Folder does not exist."
})
if self.filter == "images":
files = files.instance_of(Image)
return JsonResponse({
"folder": {
"id":
folder.id if folder else 0,
"name":
get_folder_name(folder),
"files": [
filer_file_to_json_dict(file, user=self.user)
for file in files if file.is_public
],
"folders": [
# Explicitly pass empty list of children to avoid recursion
filer_folder_to_json_dict(subfolder,
children=(),
user=self.user)
for subfolder in subfolders.order_by("name")
]
}
})
def test_get_folders_without_view_all_permission(rf):
shop = factories.get_default_shop()
staff_user = factories.UserFactory(is_staff=True)
permission_group = factories.get_default_permission_group()
staff_user.groups.add(permission_group)
shop.staff_members.add(staff_user)
set_permissions_for_group(permission_group, ["upload-media"])
assert not can_see_root_folder(staff_user)
# Create a structure and retrieve it
folder1 = get_or_create_folder(shop, printable_gibberish())
folder1_media_folder = ensure_media_folder(shop, folder1)
folder1_media_folder.owners.add(staff_user)
folder2 = get_or_create_folder(shop, printable_gibberish())
folder3 = get_or_create_folder(shop, printable_gibberish())
folder4 = get_or_create_folder(shop, printable_gibberish())
folder4.parent = folder2
folder4.save()
folder4_media_folder = ensure_media_folder(shop, folder4)
folder4_media_folder.owners.add(staff_user)
folder5 = get_or_create_folder(shop, printable_gibberish())
folder5.parent = folder4
folder5.save()
folder6 = get_or_create_folder(shop, printable_gibberish())
folder6.parent = folder5
folder6.save()
folder6_media_folder = ensure_media_folder(shop, folder6)
folder6_media_folder.owners.add(staff_user)
folder7 = get_or_create_folder(shop, printable_gibberish())
folder7.parent = folder6
folder7.save()
tree = get_id_tree(mbv_command(staff_user, {"action": "folders"}, "GET"))
assert set((folder1.id, folder4.id)) <= set(tree.keys())