diff --git a/tests/agenda/tests.py b/tests/agenda/tests.py index f04b9424a..77fe1ce33 100644 --- a/tests/agenda/tests.py +++ b/tests/agenda/tests.py @@ -1,5 +1,7 @@ # -*- coding: utf-8 -*- +from django.contrib.auth.models import Permission +from django.contrib.contenttypes.models import ContentType from django.test.client import Client from mock import patch @@ -220,6 +222,31 @@ class ViewTest(TestCase): self.assertRedirects(response, '/agenda/') self.assertTrue(Item.objects.filter(pk=self.item1.pk).exists()) + def test_orga_item_permission(self): + # Prepare + self.item1.type = Item.ORGANIZATIONAL_ITEM + self.item1.save() + user = User.objects.create(username='testuser_EeBoPh5uyookoowoodii') + user.reset_password('default') + client = Client() + client.login(username='testuser_EeBoPh5uyookoowoodii', password='default') + # Test view with permission + self.assertTrue(user.has_perm('agenda.can_see_orga_items')) + self.assertContains(client.get('/agenda/1/'), 'item1') + # Remove permission + orga_perm = Permission.objects.get( + content_type=ContentType.objects.get_for_model(Item), + codename='can_see_orga_items') + user.groups.get(name='Registered').permissions.remove(orga_perm) + # Reload user + user = User.objects.get(username=user.username) + # Test view without permission + self.assertFalse(user.has_perm('agenda.can_see_orga_items')) + response = client.get('/agenda/1/') + self.assertEqual(response.status_code, 403) + response = client.get('/agenda/2/') + self.assertEqual(response.status_code, 200) + class ConfigTest(TestCase): def setUp(self): diff --git a/tests/core/test_views.py b/tests/core/test_views.py index 605876e6a..31796be81 100644 --- a/tests/core/test_views.py +++ b/tests/core/test_views.py @@ -5,6 +5,7 @@ from mock import MagicMock, patch from openslides import get_version from openslides.agenda.models import Item +from openslides.config.api import config from openslides.participant.models import User from openslides.utils.test import TestCase @@ -51,3 +52,9 @@ class SearchViewTest(TestCase): response = self.client.get('/search/?q=agenda_item_bnghfd') text = 'agenda_item_bnghfdjkgndkjdfg' self.assertContains(response, text) + + def test_anonymous(self): + self.assertFalse(config['system_enable_anonymous']) + self.assertEqual(Client().get('/search/').status_code, 403) + config['system_enable_anonymous'] = True + self.assertEqual(Client().get('/search/').status_code, 200)