hovel / pybbm

Django forum solution. Tested, documented, shipped with example project.
BSD 2-Clause "Simplified" License
225 stars 151 forks source link

Fixes permissions and add documentation for default permissions #266

Closed DylannCordel closed 7 years ago

DylannCordel commented 7 years ago

There were some errors in permissions. With this PR, many permissions tests are added, permissions errors are fixed and a documentation page is added with permissions tables for some user types.

Modifications for old/new permissions can be viewed with the documentation update: @8148874a78ed9738fd79bf5be0a79be4fca1e39a

Note about the "view other on moderation post" update which could seem strange: filter_posts (and topics) ignore on_moderation flag when PREMODERATION is set to False. So old behaviour was to not exclude on_moderation posts. But the may_view test didn't ignore the flag: there was an inconsistency between those 2 permissions tests. The "new" behaviour keep the old one for filtering (on_moderation posts are not ignored if PREMODERATION is OFF) but now, may_view_post do the same. That's why, "view other on moderation post" is now "yes" and was (falsly) "no".

I chose this behaviour to stay the most backward-compatible. This PR mainly restrict perms that users should not do have (isstaff users without permissions) and add consistency between `filterandmayviewor betweenmay_post|deleteandmay_view`.

coveralls commented 7 years ago

Coverage Status

Changes Unknown when pulling 8148874a78ed9738fd79bf5be0a79be4fca1e39a on webu:fixes/permissions into on hovel:master.

lampslave commented 7 years ago

Thanks a lot.