Skip to content

Commit

Permalink
disable, delete, activate using pk instead of id_number
Browse files Browse the repository at this point in the history
  • Loading branch information
zalun committed Jul 12, 2012
1 parent a87b86b commit f2020d3
Show file tree
Hide file tree
Showing 4 changed files with 19 additions and 23 deletions.
9 changes: 3 additions & 6 deletions apps/jetpack/models.py
Expand Up @@ -1711,18 +1711,15 @@ def get_latest_revision_number_url(self):

def get_disable_url(self):
" returns URL to the disable package functionality "
return reverse('jp_package_disable',
args=[self.id_number])
return reverse('jp_package_disable', args=[self.pk])

def get_activate_url(self):
" returns URL to activate disabled package "
return reverse('jp_package_activate',
args=[self.id_number])
return reverse('jp_package_activate', args=[self.pk])

def get_delete_url(self):
" returns URL to delete package "
return reverse('jp_package_delete',
args=[self.id_number])
return reverse('jp_package_delete', args=[self.pk])

def get_view_on_amo_url(self):
" returns the url to view the add-on on AMO "
Expand Down
9 changes: 4 additions & 5 deletions apps/jetpack/tests/test_views.py
Expand Up @@ -66,7 +66,7 @@ def test_author_can_edit_package(self):
assert 'save_url' in response.content
# after setting the addon to private
response = self.client.get(reverse('jp_package_disable',
args=[addon.id_number]))
args=[addon.pk]))
self.client.login(username=user.username, password='secure')
response = self.client.get(addon.get_absolute_url())
assert 'save_url' in response.content
Expand All @@ -84,8 +84,7 @@ def test_display_deleted_package(self):
# logging in the author
self.client.login(username=author.username, password='secure')
# deleting lib
response = self.client.get(reverse('jp_package_delete',
args=[lib.id_number]))
response = self.client.get(reverse('jp_package_delete', args=[lib.pk]))
eq_(response.status_code, 200)
response = self.client.get(lib.get_absolute_url())
# lib deleted - shouldn't be visible by author
Expand All @@ -108,7 +107,7 @@ def test_display_disabled_package(self):
self.client.login(username=author.username, password='secure')
# private on
response = self.client.get(reverse('jp_package_disable',
args=[lib.id_number]))
args=[lib.pk]))
eq_(response.status_code, 200)
response = self.client.get(lib.get_absolute_url())
# lib private - should be visible by author
Expand All @@ -133,7 +132,7 @@ def test_display_disabled_library_in_addon(self):
self.client.login(username=author.username, password='secure')
# private on
response = self.client.get(reverse('jp_package_disable',
args=[lib.id_number]))
args=[lib.pk]))
eq_(response.status_code, 200)
# logging in the user
self.client.login(username=user.username, password='secure')
Expand Down
6 changes: 3 additions & 3 deletions apps/jetpack/urls.py
Expand Up @@ -65,11 +65,11 @@
'save', name='jp_revision_save'),

# disable/activate/delete package
url(r'^package/disable/(?P<id_number>[-\w]+)/$',
url(r'^package/disable/(?P<pk>[-\w]+)/$',
'disable', name='jp_package_disable'),
url(r'^package/activate/(?P<id_number>[-\w]+)/$',
url(r'^package/activate/(?P<pk>[-\w]+)/$',
'activate', name='jp_package_activate'),
url(r'^package/delete/(?P<id_number>[-\w]+)/$',
url(r'^package/delete/(?P<pk>[-\w]+)/$',
'delete', name='jp_package_delete'),

# get all, conflicting modules
Expand Down
18 changes: 9 additions & 9 deletions apps/jetpack/views.py
Expand Up @@ -252,14 +252,14 @@ def copy(request, revision_id):


@login_required
def disable(request, id_number):
def disable(request, pk):
"""
Disable Package and return confirmation
"""
package = get_object_or_404(Package, id_number=id_number)
package = get_object_or_404(Package, pk=pk)
if request.user.pk != package.author.pk:
log_msg = 'User %s wanted to disable not his own Package %s.' % (
request.user, id_number)
request.user, pk)
log.warning(log_msg)
return HttpResponseForbidden(
'You are not the author of this %s' % escape(
Expand All @@ -273,14 +273,14 @@ def disable(request, id_number):


@login_required
def activate(request, id_number):
def activate(request, pk):
"""
Undelete Package and return confirmation
"""
package = get_object_or_404(Package, id_number=id_number)
package = get_object_or_404(Package, pk=pk)
if request.user.pk != package.author.pk:
log_msg = ("[security] Attempt to activate package (%s) by "
"non-owner (%s)" % (id_number, request.user))
"non-owner (%s)" % (pk, request.user))
log.warning(log_msg)
return HttpResponseForbidden(
'You are not the author of this %s' % escape(
Expand All @@ -294,14 +294,14 @@ def activate(request, id_number):


@login_required
def delete(request, id_number):
def delete(request, pk):
"""
Delete Package and return confirmation
"""
package = get_object_or_404(Package, id_number=id_number)
package = get_object_or_404(Package, pk=pk)
if request.user.pk != package.author.pk:
log_msg = ("[security] Attempt to delete package (%s) by "
"non-owner (%s)" % (id_number, request.user))
"non-owner (%s)" % (pk, request.user))
log.warning(log_msg)
return HttpResponseForbidden(
'You are not the author of this %s' % escape(
Expand Down

0 comments on commit f2020d3

Please sign in to comment.