From bfe6768796a15afd0b748f9c26a4a5f85812403c Mon Sep 17 00:00:00 2001
From: Alexey Bezhan <al@fueledbylemons.com>
Date: Wed, 20 Mar 2019 17:26:51 +0000
Subject: [PATCH] Add user permission check to template folder actions

---
 app/main/views/templates.py            |  9 +++++----
 app/models/service.py                  | 15 ++++++++++-----
 tests/app/main/views/test_send.py      |  4 ++--
 tests/app/main/views/test_templates.py |  5 +++++
 4 files changed, 22 insertions(+), 11 deletions(-)

diff --git a/app/main/views/templates.py b/app/main/views/templates.py
index 90afd139d..5221c0631 100644
--- a/app/main/views/templates.py
+++ b/app/main/views/templates.py
@@ -160,6 +160,7 @@ def choose_template(service_id, template_type='all', template_folder_id=None):
 
 
 def process_folder_management_form(form, current_folder_id):
+    current_service.get_template_folder_with_user_permission_or_403(current_folder_id, current_user)
     new_folder_id = None
 
     if form.is_add_template_op:
@@ -438,10 +439,10 @@ def action_blocked(service_id, notification_type, return_to, template_id):
 @login_required
 @user_has_permissions('manage_templates')
 def manage_template_folder(service_id, template_folder_id):
-    current_folder = current_service.get_template_folder(template_folder_id)
+    template_folder = current_service.get_template_folder_with_user_permission_or_403(template_folder_id, current_user)
     form = TemplateFolderForm(
-        name=current_folder['name'],
-        users_with_permission=current_folder.get('users_with_permission', None),
+        name=template_folder['name'],
+        users_with_permission=template_folder.get('users_with_permission', None),
         all_service_users=[user for user in current_service.active_users if user.id != current_user.id]
     )
     if form.validate_on_submit():
@@ -470,7 +471,7 @@ def manage_template_folder(service_id, template_folder_id):
 @login_required
 @user_has_permissions('manage_templates')
 def delete_template_folder(service_id, template_folder_id):
-    template_folder = current_service.get_template_folder(template_folder_id)
+    template_folder = current_service.get_template_folder_with_user_permission_or_403(template_folder_id, current_user)
 
     if len(current_service.get_template_folders_and_templates(
         template_type="all", template_folder_id=template_folder_id
diff --git a/app/models/service.py b/app/models/service.py
index 3b53b6f1d..2787eb209 100644
--- a/app/models/service.py
+++ b/app/models/service.py
@@ -174,17 +174,22 @@ class Service():
     def get_template(self, template_id, version=None):
         return service_api_client.get_service_template(self.id, str(template_id), version)['data']
 
-    def get_template_with_user_permission_or_403(self, template_id, user):
-        template = self.get_template(template_id)
+    def get_template_folder_with_user_permission_or_403(self, folder_id, user):
+        template_folder = self.get_template_folder(folder_id)
 
         if not self.has_permission("edit_folder_permissions"):
-            return template
-
-        template_folder = self.get_template_folder(template["folder"])
+            return template_folder
 
         if not user.has_template_folder_permission(template_folder):
             abort(403)
 
+        return template_folder
+
+    def get_template_with_user_permission_or_403(self, template_id, user):
+        template = self.get_template(template_id)
+
+        self.get_template_folder_with_user_permission_or_403(template['folder'], user)
+
         return template
 
     @property
diff --git a/tests/app/main/views/test_send.py b/tests/app/main/views/test_send.py
index 70726e30a..3fa335965 100644
--- a/tests/app/main/views/test_send.py
+++ b/tests/app/main/views/test_send.py
@@ -1481,7 +1481,7 @@ def test_send_test_sms_message_redirects_with_help_argument(
     user,
 ):
     mocker.patch('app.user_api_client.get_user', return_value=user(fake_uuid))
-    template = {'data': {'template_type': 'sms'}}
+    template = {'data': {'template_type': 'sms', 'folder': None}}
     mocker.patch('app.service_api_client.get_service_template', return_value=template)
 
     client_request.get(
@@ -1839,7 +1839,7 @@ def test_send_test_clears_session(
     service_one,
     fake_uuid,
 ):
-    template = {'data': {'template_type': 'sms'}}
+    template = {'data': {'template_type': 'sms', 'folder': None}}
     mocker.patch('app.service_api_client.get_service_template', return_value=template)
 
     with client_request.session_transaction() as session:
diff --git a/tests/app/main/views/test_templates.py b/tests/app/main/views/test_templates.py
index 48e0524b3..a66d7ac77 100644
--- a/tests/app/main/views/test_templates.py
+++ b/tests/app/main/views/test_templates.py
@@ -1727,8 +1727,13 @@ def test_should_redirect_when_deleting_a_template(
     mocker,
     client_request,
     mock_delete_service_template,
+    mock_get_template_folders,
     parent,
 ):
+
+    mock_get_template_folders.return_value = [
+        {'id': PARENT_FOLDER_ID, 'name': 'Folder', 'parent': None, 'users_with_permission': []}
+    ]
     mock_get_service_template = mocker.patch(
         'app.service_api_client.get_service_template',
         return_value={'data': _template(