diff --git a/ckan/controllers/group.py b/ckan/controllers/group.py index 61f6a76b20f..b01050d37fc 100644 --- a/ckan/controllers/group.py +++ b/ckan/controllers/group.py @@ -159,6 +159,7 @@ def index(self): sort_by = c.sort_by_selected = request.params.get('sort') try: self._check_access('site_read', context) + self._check_access('group_list', context) except NotAuthorized: abort(403, _('Not authorized to see this page')) diff --git a/ckan/tests/controllers/test_organization.py b/ckan/tests/controllers/test_organization.py index ce8a875928b..549a92aa9f1 100644 --- a/ckan/tests/controllers/test_organization.py +++ b/ckan/tests/controllers/test_organization.py @@ -1,6 +1,7 @@ from bs4 import BeautifulSoup from nose.tools import assert_equal, assert_true from routes import url_for +from mock import patch from ckan.tests import factories, helpers from ckan.tests.helpers import webtest_submit, submit_and_follow, assert_in @@ -61,6 +62,22 @@ def test_all_fields_saved(self): assert_equal(group['description'], 'Sciencey datasets') +class TestOrganizationList(helpers.FunctionalTestBase): + def setup(self): + super(TestOrganizationList, self).setup() + self.app = helpers._get_test_app() + self.user = factories.User() + self.user_env = {'REMOTE_USER': self.user['name'].encode('ascii')} + self.organization_list_url = url_for(controller='organization', + action='index') + + @patch('ckan.logic.auth.get.organization_list', return_value={'success': False}) + def test_error_message_shown_when_no_organization_list_permission(self, mock_check_access): + response = self.app.get(url=self.organization_list_url, + extra_environ=self.user_env, + status=403) + + class TestOrganizationRead(helpers.FunctionalTestBase): def setup(self): super(TestOrganizationRead, self).setup()