Commit 4082a2f9 authored by Matthieu Gautier's avatar Matthieu Gautier

A hidden content can be displayed in the mediacenter index view.

Now in the index view :
- A hidden content is never display to a non staff user.
- Staff user can chose to see or not hidden contents.
parent 546f6a16
Pipeline #18504 passed with stage
in 5 minutes and 39 seconds
......@@ -26,6 +26,18 @@
{% if user.is_staff %}
<div class="card tinted admin">
{% fa 'plus' 'fa-fw' %} <a href="{% url 'mediacenter:document_create' %}">{% trans "Add a document" %}</a>
<br />
{% fa 'eye-slash' 'fa-fw' %}
{% is_in_qs 'hidden' as in_qs %}
{% if in_qs %}
<a href="{% remove_qs 'hidden' %}" class="flatlist">
{% trans 'Hide hidden media' %}
</a>
{% else %}
<a href="{% add_qs 'hidden' %}" class="flatlist">
{% trans 'Show hidden media' %}
</a>
{% endif %}
</div>
{% endif %}
{% url 'mediacenter:index' as index %}
......
......@@ -629,13 +629,29 @@ def test_index_should_not_show_hidden_content_to_user(app):
assert hidden.title not in response.text
def test_index_can_show_hidden_content_to_staff(staffapp):
shown = DocumentFactory()
hidden = DocumentFactory(hidden=True)
response = staffapp.get(reverse('mediacenter:index'))
assert shown.title in response.text
assert hidden.title not in response.text
response = staffapp.get(reverse('mediacenter:index'),
params={'hidden':''})
assert shown.title in response.text
assert hidden.title in response.text
def test_user_cannot_access_detail_page_of_hidden_content(app):
document = DocumentFactory(hidden=True)
app.get(reverse('mediacenter:document_detail',
kwargs={'pk': document.pk}), status=403)
def test_staff_cannot_access_detail_page_of_hidden_content(staffapp):
def test_staff_can_access_detail_page_of_hidden_content(staffapp):
document = DocumentFactory(hidden=True)
staffapp.get(reverse('mediacenter:document_detail',
kwargs={'pk': document.pk}), status=403)
kwargs={'pk': document.pk}), status=200)
......@@ -71,7 +71,12 @@ class Index(FilterableViewMixin, OrderableViewMixin, ListView):
def get_queryset(self):
qs = super().get_queryset()
qs = qs.filter(hidden=False)
if not self.request.user.is_staff:
qs = qs.filter(hidden=False)
else:
show_hidden = 'hidden' in self.request.GET
if not show_hidden:
qs = qs.filter(hidden=False)
return qs
index = Index.as_view()
......@@ -85,7 +90,7 @@ class DocumentDetail(DetailView):
model = Document
def get_object(self, *args, **kwargs):
object = super().get_object(*args, **kwargs)
if object.hidden:
if object.hidden and not self.request.user.is_staff:
raise PermissionDenied
return object
document_detail = DocumentDetail.as_view()
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment