Changeset 12166

Timestamp:

7 Dec 2014, 22:24:03 (10 years ago)

Author:

Henrik Bettermann

Message:

We need to protect also the manage form page of documents. Officers are only allowed to edit documents in state created.

Location:

main/waeup.ikoba/trunk/src/waeup/ikoba/customers

Files:

• browser.py (modified) (3 diffs)
• documents.py (modified) (2 diffs)
• export.py (modified) (1 diff)
• interfaces.py (modified) (1 diff)
• tests/test_browser.py (modified) (1 diff)
• viewlets.py (modified) (2 diffs)

main/waeup.ikoba/trunk/src/waeup/ikoba/customers/browser.py

@@ -843 +843 @@
     pnav = 4
 
-    #@property
-    #def label(self):
-    #    return _('${a}: Document ${b}', mapping = {
-    #        'a':self.context.customer.display_fullname,
-    #        'b':self.context.document_id})
-
     @property
     def label(self):
@@ -865 +859 @@
     deletion_warning = _('Are you sure?')
 
-    #@property
-    #def label(self):
-    #    return _('${a}: Document ${b}', mapping = {
-    #        'a':self.context.customer.display_fullname,
-    #        'b':self.context.document_id})
+    def update(self):
+        if not self.context.is_editable_by_manager:
+            emit_lock_message(self)
+            return
+        return super(DocumentManageFormPage, self).update()
 
     @property
@@ -888 +882 @@
 
     def update(self):
-        if not self.context.is_editable:
+        if not self.context.is_editable_by_customer:
             emit_lock_message(self)
             return

main/waeup.ikoba/trunk/src/waeup/ikoba/customers/documents.py

@@ -90 +90 @@
 
     @property
-    def is_editable(self):
+    def is_editable_by_customer(self):
         try:
             # Customer must be approved
@@ -105 +105 @@
 
     @property
+    def is_editable_by_manager(self):
+        try:
+            # Document must be in state created
+            cond = self.state in getUtility(
+                ICustomersUtils).DOCMANAGE_DOCUMENT_STATES
+            if not cond:
+                return False
+        except AttributeError:
+            pass
+        return True
+
+    @property
     def translated_class_name(self):
         try:

main/waeup.ikoba/trunk/src/waeup/ikoba/customers/export.py

@@ -157 +157 @@
             ICustomerDocument,
             exclude_attribs=False,
-            omit=['is_editable',
+            omit=['is_editable_by_customer',
+                  'is_editable_by_manager',
                   'translated_state',
                   'formatted_transition_date',

main/waeup.ikoba/trunk/src/waeup/ikoba/customers/interfaces.py

@@ -240 +240 @@
     """
 
-    is_editable = Attribute('Document editable by customer')
+    is_editable_by_customer = Attribute('Document editable by customer')
+    is_editable_by_manager = Attribute('Document editable by manager')
     translated_class_name = Attribute('Translatable class name')
 

main/waeup.ikoba/trunk/src/waeup/ikoba/customers/tests/test_browser.py

@@ -853 +853 @@
         self.assertEqual(document.state, 'verified')
 
+        # Manage button and form is no longer available
+        self.browser.open(self.documents_path + '/d102/index')
+        self.assertFalse(
+            'href="http://localhost/app/customers/K1000000/documents/d102/manage"'
+            in self.browser.contents)
+        self.browser.open(self.documents_path + '/d102/manage')
+        self.assertTrue(
+            'The requested form is locked (read-only)'
+            in self.browser.contents)
+
         # Documents can be removed
         self.browser.getLink("Documents").click()

main/waeup.ikoba/trunk/src/waeup/ikoba/customers/viewlets.py

@@ -327 +327 @@
     target = 'manage'
 
+    @property
+    def target_url(self):
+        if not self.context.is_editable_by_manager:
+            return ''
+        return self.view.url(self.view.context, self.target)
+
 
 class DocumentEditActionButton(ManageActionButton):
@@ -338 +344 @@
     @property
     def target_url(self):
-        if not self.context.is_editable:
+        if not self.context.is_editable_by_customer:
             return ''
         return self.view.url(self.view.context, self.target)