darkhelm/notifications-admin
1
0
Fork 0
mirror of https://github.com/GSA/notifications-admin.git synced 2026-08-19 05:59:44 -04:00
Code Issues Packages Projects Releases Wiki Activity

Only show branding description pages if branding allowed for service

Browse Source 
It shouldn't be possible to view the page to confirm that you want a
particular type of email branding if that branding is not allowed for
your service. Although we don't show banned branding options on the
branding form, it would have been possible to visit the relevant URLs
directly.

We now give a `404` status page if you visit a page to select branding
that isn't allowed.
This commit is contained in:
Katie Smith
2022-02-02 16:21:36 +00:00
parent f9c551a558
commit f92167de71
2 changed files with 62 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
app/main/views/service_settings.py
View File

@@ -1191,11 +1191,21 @@ def email_branding_request(service_id):
)
def check_branding_allowed_for_service(branding):
allowed_branding_for_service = dict(
BrandingOptions.get_available_choices(current_service, branding_type='email')
)
if branding not in allowed_branding_for_service:
abort(404)
@main.route("/services/<uuid:service_id>/service-settings/email-branding/govuk", methods=['GET', 'POST'])
@user_has_permissions('manage_service')
def email_branding_govuk(service_id):
with_org = request.args.get('with_org')
check_branding_allowed_for_service('govuk_and_org' if with_org else 'govuk')
if request.method == 'POST':
create_email_branding_zendesk_ticket(request.form['branding_choice'])
@@ -1208,6 +1218,8 @@ def email_branding_govuk(service_id):
@main.route("/services/<uuid:service_id>/service-settings/email-branding/nhs", methods=['GET', 'POST'])
@user_has_permissions('manage_service')
def email_branding_nhs(service_id):
check_branding_allowed_for_service('nhs')
if request.method == 'POST':
create_email_branding_zendesk_ticket('nhs')
@@ -1220,6 +1232,8 @@ def email_branding_nhs(service_id):
@main.route("/services/<uuid:service_id>/service-settings/email-branding/organisation", methods=['GET', 'POST'])
@user_has_permissions('manage_service')
def email_branding_organisation(service_id):
check_branding_allowed_for_service('organisation')
if request.method == 'POST':
create_email_branding_zendesk_ticket('organisation')
@@ -1232,6 +1246,8 @@ def email_branding_organisation(service_id):
@main.route("/services/<uuid:service_id>/service-settings/email-branding/something-else", methods=['GET', 'POST'])
@user_has_permissions('manage_service')
def email_branding_something_else(service_id):
check_branding_allowed_for_service('something_else')
form = SomethingElseBrandingForm()
if form.validate_on_submit():