Aaryan123456679 commented on code in PR #70243:
URL: https://github.com/apache/airflow/pull/70243#discussion_r4064963606
##########
providers/fab/tests/unit/fab/www/views/test_views_custom_user_views.py:
##########
@@ -141,6 +141,49 @@ def test_user_model_view_with_access(self, url,
permission, expected_text, app,
response = client.get(url.replace("{user.id}",
str(user_with_access.id)), follow_redirects=True)
check_content_in_response(expected_text, response)
+ def test_user_edit_view_shows_reset_password_action_with_access(self, app,
client):
+ # Visibility of the action link is gated on "read" access to Users
(the same
+ # rule the Show User view relies on); "read" on Passwords is what's
required to
+ # actually perform the reset once the link is followed.
+ user_with_access = create_user(
+ app,
+ username="has_access",
+ role_name="role_has_access",
+ permissions=[
+ (permissions.ACTION_CAN_READ, permissions.RESOURCE_WEBSITE),
+ (permissions.ACTION_CAN_READ, permissions.RESOURCE_USER),
+ (permissions.ACTION_CAN_EDIT, permissions.RESOURCE_USER),
+ (permissions.ACTION_CAN_READ, permissions.RESOURCE_PASSWORD),
Review Comment:
Added
test_user_edit_view_shows_reset_password_action_without_passwords_read_access
(b2a25d6210). The user has read and edit on Users but no read on Passwords. The
test asserts the "Reset Password" link renders, and that POSTing the action,
which is what the button submits, does not reach the reset form.
I also extended the existing with-access test so the same POST does redirect
to /resetpassword/form. That way the denial check can't pass just because the
POST is broken.
While writing it I found that a GET on /users/action/resetpasswords/<id> is
refused for CSRF reasons before any permission check runs, so a GET-based check
wouldn't have exercised the Passwords-read gate at all.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
