Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(category permissions) role must match for child and parent #2486

Merged
merged 4 commits into from
Feb 21, 2018

Conversation

rowasc
Copy link
Contributor

@rowasc rowasc commented Feb 20, 2018

This pull request makes the following changes:

  • Fixes permission check on tag create/update

Test checklist:

Fixes ushahidi/platform# .

Ping @ushahidi/platform

@@ -174,12 +174,13 @@ public function deleteTag($id)
public function isRoleValid(Validation $validation, $fullData)
{
$valid = true;
$isChild = $fullData['parent_id'];
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@willdoran had to refactor this.

  1. I had a dumb bug checking $valid incorrectly, I suspect I had tested and then changed something. Aaaanyway. FIxed now
  2. I realized I needed to use entities otherwise we need to wrangle the fulldata role formats and we really shouldn't need to do that!
  3. Fixed tests to actually, you know.. test the correct thing.

@rowasc rowasc requested a review from willdoran February 20, 2018 17:51
Copy link
Contributor

@willdoran willdoran left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So if its a child the role has to be the same as the parent yes? Do we give a clear warning when that isn't the case - as in from the message we send back can you work out that you aren't allowed to set a different role than that of the parent?

@rowasc
Copy link
Contributor Author

rowasc commented Feb 21, 2018

@willdoran yep, that's correct .

About the warning: IF that happens (when editing children we don't show a way to edit the role, it is always the parent's role) we would send back a message with a 422 that says "Role must match the parent category" (70e91c9#diff-05eed86ed0c3b7db17b92d1d4fbf735a)

This was mostly for preventing any type of client bugs with role settings from messing up the database and for preventing postman/ cli based post creation from messing up the category permissions.

@rowasc rowasc merged commit a5c1549 into develop Feb 21, 2018
@rowasc rowasc deleted the fix-perm-categories branch February 21, 2018 22:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants