def test_can_see_root_folder(rf, admin_user): assert not can_see_root_folder(None) assert can_see_root_folder(admin_user) shop = factories.get_default_shop() staff_user = factories.UserFactory(is_staff=True) assert not can_see_root_folder(staff_user) permission_group = factories.get_default_permission_group() staff_user.groups.add(permission_group) shop.staff_members.add(staff_user) set_permissions_for_group(permission_group, ["media.view-all"]) assert can_see_root_folder(staff_user)
def test_media_view_images_without_root_access(rf): shop = factories.get_default_shop() staff_user = factories.UserFactory(is_staff=True) permission_group = factories.get_default_permission_group() staff_user.groups.add(permission_group) shop.staff_members.add(staff_user) set_permissions_for_group(permission_group, ["upload-media"]) assert not can_see_root_folder(staff_user) folder = get_or_create_folder(shop, "Root") File.objects.create(name="normalfile", folder=folder) img = Image.objects.create(name="imagefile", folder=folder, is_public=True) request = apply_request_middleware(rf.get("/", { "filter": "images", "action": "folder" }), user=staff_user) request.user = staff_user view_func = MediaBrowserView.as_view() response = view_func(request) assert isinstance(response, JsonResponse) content = json.loads(response.content.decode("utf-8")) assert len(content["folder"]["folders"]) == 0 assert len(content["folder"]["files"]) == 0
def handle_get_folder(self, data): shop = get_shop(self.request) try: folder_id = int(data.get("id", 0)) if folder_id: folder = _get_folder_query(shop, self.user).get(pk=folder_id) subfolders = folder.get_children().filter( _get_folder_query_filter(shop, self.user)) files = _get_file_query(shop, folder) else: folder = None if can_see_root_folder(self.request.user): subfolders = _get_folder_query( shop, self.user).filter(parent=None) files = _get_file_query(shop).filter(folder=None) else: files = File.objects.none() subfolders = Folder.objects.none() except ObjectDoesNotExist: return JsonResponse({ "folder": None, "error": "Error! Folder does not exist." }) if self.filter == "images": files = files.instance_of(Image) return JsonResponse({ "folder": { "id": folder.id if folder else 0, "name": get_folder_name(folder), "files": [ filer_file_to_json_dict(file, user=self.user) for file in files if file.is_public ], "folders": [ # Explicitly pass empty list of children to avoid recursion filer_folder_to_json_dict(subfolder, children=(), user=self.user) for subfolder in subfolders.order_by("name") ] } })
def test_get_folders_without_view_all_permission(rf): shop = factories.get_default_shop() staff_user = factories.UserFactory(is_staff=True) permission_group = factories.get_default_permission_group() staff_user.groups.add(permission_group) shop.staff_members.add(staff_user) set_permissions_for_group(permission_group, ["upload-media"]) assert not can_see_root_folder(staff_user) # Create a structure and retrieve it folder1 = get_or_create_folder(shop, printable_gibberish()) folder1_media_folder = ensure_media_folder(shop, folder1) folder1_media_folder.owners.add(staff_user) folder2 = get_or_create_folder(shop, printable_gibberish()) folder3 = get_or_create_folder(shop, printable_gibberish()) folder4 = get_or_create_folder(shop, printable_gibberish()) folder4.parent = folder2 folder4.save() folder4_media_folder = ensure_media_folder(shop, folder4) folder4_media_folder.owners.add(staff_user) folder5 = get_or_create_folder(shop, printable_gibberish()) folder5.parent = folder4 folder5.save() folder6 = get_or_create_folder(shop, printable_gibberish()) folder6.parent = folder5 folder6.save() folder6_media_folder = ensure_media_folder(shop, folder6) folder6_media_folder.owners.add(staff_user) folder7 = get_or_create_folder(shop, printable_gibberish()) folder7.parent = folder6 folder7.save() tree = get_id_tree(mbv_command(staff_user, {"action": "folders"}, "GET")) assert set((folder1.id, folder4.id)) <= set(tree.keys())