darkhelm/notifications-admin
1
0
Fork 0
mirror of https://github.com/GSA/notifications-admin.git synced 2026-08-20 14:29:51 -04:00
Code Issues Packages Projects Releases Wiki Activity

Fix wrong permissions on dashboard pages

Browse Source 
Anyone with access to a service should be able to see:
- monthly breakdown (non financial)
- incoming messages

Adds tests to check the same.
This commit is contained in:
Chris Hill-Scott
2017-07-07 15:58:40 +01:00
parent cfa63b450e
commit 037970c48c
3 changed files with 65 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
app/main/views/dashboard.py
View File

@@ -122,7 +122,7 @@ def usage(service_id):
@main.route("/services/<service_id>/monthly")
@login_required
@user_has_permissions('manage_settings', admin_override=True)
@user_has_permissions('view_activity', admin_override=True)
def monthly(service_id):
year, current_financial_year = requested_and_current_financial_year(request)
return render_template(
@@ -140,7 +140,7 @@ def monthly(service_id):
@main.route("/services/<service_id>/inbox")
@login_required
@user_has_permissions('manage_settings', admin_override=True)
@user_has_permissions('view_activity', admin_override=True)
def inbox(service_id):
if 'inbound_sms' not in current_service['permissions']: