diff options
| author | Dave Arter <davea@mysociety.org> | 2017-09-01 11:44:46 +0100 |
|---|---|---|
| committer | Dave Arter <davea@mysociety.org> | 2017-09-01 16:50:13 +0100 |
| commit | ac5e03fae0c3d9916ececd830405b5f299a0b430 (patch) | |
| tree | 1ff338cc8b35ba241b4a3b41035f7847b7c8419a | |
| parent | bd69f35b39b34318c4be76beb0148e0000193b24 (diff) | |
Superusers only have permissions available on the current cobrand
| -rw-r--r-- | perllib/FixMyStreet/DB/Result/User.pm | 10 | ||||
| -rw-r--r-- | t/app/sendreport/inspection_required.t | 3 |
2 files changed, 13 insertions, 0 deletions
diff --git a/perllib/FixMyStreet/DB/Result/User.pm b/perllib/FixMyStreet/DB/Result/User.pm index e44b2530f..19adf5d49 100644 --- a/perllib/FixMyStreet/DB/Result/User.pm +++ b/perllib/FixMyStreet/DB/Result/User.pm @@ -295,6 +295,16 @@ sub permissions { sub has_permission_to { my ($self, $permission_type, $body_ids) = @_; + # Nobody, including superusers, can have a permission which isn't available + # in the current cobrand. + my $cobrand = $self->result_source->schema->cobrand; + my $cobrand_perms = $cobrand->available_permissions; + my %available = map { %$_ } values %$cobrand_perms; + # The 'trusted' permission is never set in the cobrand's + # available_permissions (see note there in Default.pm) so include it here. + $available{trusted} = 1; + return 0 unless $available{$permission_type}; + return 1 if $self->is_superuser; return 0 if !$body_ids || (ref $body_ids && !@$body_ids); $body_ids = [ $body_ids ] unless ref $body_ids; diff --git a/t/app/sendreport/inspection_required.t b/t/app/sendreport/inspection_required.t index 73bdd14f7..c8cb30592 100644 --- a/t/app/sendreport/inspection_required.t +++ b/t/app/sendreport/inspection_required.t @@ -5,6 +5,9 @@ use FixMyStreet::SendReport::Email; ok( my $mech = FixMyStreet::TestMech->new, 'Created mech object' ); +use_ok 'FixMyStreet::Cobrand'; +FixMyStreet::DB->schema->cobrand(FixMyStreet::Cobrand::FixMyStreet->new()); + my $user = $mech->create_user_ok( 'user@example.com' ); my $body = $mech->create_body_ok( 2237, 'Oxfordshire County Council'); |