Merge pull request #3558 from alphagov/only-allow-new-template-if-permission-is-there

Services can only create templates of types they have turned on
This commit is contained in:
Pea M. Tyczynska
2020-08-17 14:39:16 +01:00
committed by GitHub
8 changed files with 121 additions and 20 deletions

View File

@@ -1997,12 +1997,8 @@ class TemplateAndFoldersSelectionForm(Form):
]
self.add_template_by_template_type.choices = list(filter(None, [
# We want to show email and text message to everyone,
# whether or not the service has them switched on. The
# option to add letter or broadcast templates should only
# be shown to services which have that permission
('email', 'Email'),
('sms', 'Text message'),
('email', 'Email') if 'email' in available_template_types else None,
('sms', 'Text message') if 'sms' in available_template_types else None,
('letter', 'Letter') if 'letter' in available_template_types else None,
('broadcast', 'Broadcast') if 'broadcast' in available_template_types else None,
('copy-existing', 'Copy an existing template') if allow_adding_copy_of_template else None,

View File

@@ -31,6 +31,7 @@ from app.models.service import Service
from app.models.template_list import TemplateList, TemplateLists
from app.template_previews import TemplatePreview, get_page_count_for_letter
from app.utils import (
NOTIFICATION_TYPES,
get_template,
should_skip_template_page,
user_has_permissions,
@@ -130,6 +131,11 @@ def choose_template(service_id, template_type='all', template_folder_id=None):
)
option_hints = {template_folder_id: 'current folder'}
single_notification_channel = None
notification_channels = list(set(current_service.permissions).intersection(NOTIFICATION_TYPES))
if len(notification_channels) == 1:
single_notification_channel = notification_channels[0]
if request.method == 'POST' and templates_and_folders_form.validate_on_submit():
if not current_user.has_permissions('manage_templates'):
abort(403)
@@ -168,6 +174,7 @@ def choose_template(service_id, template_type='all', template_folder_id=None):
templates_and_folders_form=templates_and_folders_form,
move_to_children=templates_and_folders_form.move_to.children(),
user_has_template_folder_permission=user_has_template_folder_permission,
single_notification_channel=single_notification_channel,
option_hints=option_hints
)