aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--CHANGELOG.md1
-rw-r--r--perllib/FixMyStreet/App/Controller/Alert.pm12
-rw-r--r--perllib/FixMyStreet/App/Controller/Report.pm4
-rw-r--r--t/app/controller/alert_new.t47
-rw-r--r--templates/web/base/alert/updates.html12
-rw-r--r--templates/web/base/report/display_tools.html10
-rw-r--r--templates/web/base/report/new/duplicate_suggestions.html10
7 files changed, 90 insertions, 6 deletions
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6ae350b1a..3becb564b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -30,6 +30,7 @@
- Add optional enforced password expiry.
- Store a moderation history on admin report edit.
- Add user admin log page.
+ - Allow staff users to sign other people up for alerts.
- New features:
- Categories can be listed under more than one group #2475
- OpenID Connect login support. #2523
diff --git a/perllib/FixMyStreet/App/Controller/Alert.pm b/perllib/FixMyStreet/App/Controller/Alert.pm
index f93231235..a42e7203a 100644
--- a/perllib/FixMyStreet/App/Controller/Alert.pm
+++ b/perllib/FixMyStreet/App/Controller/Alert.pm
@@ -151,7 +151,7 @@ sub updates : Path('updates') : Args(0) {
$c->forward('/auth/get_csrf_token');
$c->stash->{email} = $c->get_param('rznvy');
- $c->stash->{problem_id} = $c->get_param('id');
+ $c->stash->{email} ||= $c->user->email if $c->user_exists;
}
=head2 confirm
@@ -196,7 +196,7 @@ sub create_alert : Private {
$alert->insert();
}
- if ( $c->user && $c->user->id == $alert->user->id ) {
+ if ( $c->user_exists && ($c->user->id == $alert->user->id || $c->stash->{can_create_for_another})) {
$alert->confirm();
} else {
$alert->confirmed(0);
@@ -340,8 +340,12 @@ sub process_user : Private {
my ( $self, $c ) = @_;
if ( $c->user_exists ) {
- $c->stash->{alert_user} = $c->user->obj;
- return;
+ $c->stash->{can_create_for_another} = $c->stash->{problem}
+ && $c->user->has_permission_to(contribute_as_another_user => $c->stash->{problem}->bodies_str_ids);
+ if (!$c->stash->{can_create_for_another}) {
+ $c->stash->{alert_user} = $c->user->obj;
+ return;
+ }
}
my $email = $c->get_param('rznvy');
diff --git a/perllib/FixMyStreet/App/Controller/Report.pm b/perllib/FixMyStreet/App/Controller/Report.pm
index debf27cde..9cc810c16 100644
--- a/perllib/FixMyStreet/App/Controller/Report.pm
+++ b/perllib/FixMyStreet/App/Controller/Report.pm
@@ -91,6 +91,10 @@ sub display :PathPart('') :Chained('id') :Args(0) {
$c->stash->{template} = 'report/inspect.html';
$c->forward('inspect');
}
+
+ if ($c->user_exists && $c->user->has_permission_to(contribute_as_another_user => $c->stash->{problem}->bodies_str_ids)) {
+ $c->stash->{email} = $c->user->email;
+ }
}
sub moderate_report :PathPart('moderate') :Chained('id') :Args(0) {
diff --git a/t/app/controller/alert_new.t b/t/app/controller/alert_new.t
index 132090634..7eba90530 100644
--- a/t/app/controller/alert_new.t
+++ b/t/app/controller/alert_new.t
@@ -289,6 +289,53 @@ for my $test (
};
}
+subtest 'Test body user signing someone else up for alerts' => sub {
+ my $staff_user = $mech->create_user_ok('astaffuser@example.com', name => 'A staff user', from_body => $body);
+ $mech->log_in_ok($staff_user->email);
+
+ $mech->get_ok('/alert/subscribe?id=' . $report->id);
+ my ($csrf) = $mech->content =~ /name="token" value="([^"]*)"/;
+ $mech->post_ok('/alert/subscribe', { rznvy => 'someoneelse@example.org', id => $report->id, type => 'updates', token => $csrf });
+
+ my $user = FixMyStreet::DB->resultset('User')->find({ email => 'someoneelse@example.org' });
+ is $user, undef, 'No user made by bad request';
+
+ my $alert = FixMyStreet::DB->resultset('Alert')->find({
+ user => $staff_user,
+ alert_type => 'new_updates',
+ parameter => $report->id,
+ confirmed => 1,
+ });
+ ok $alert, 'New alert created with logged in user';
+ $alert->delete;
+
+ $staff_user->user_body_permissions->create({ permission_type => 'contribute_as_another_user', body => $body });
+ $mech->get_ok('/alert/subscribe?id=' . $report->id);
+ $mech->submit_form_ok({ with_fields => { rznvy => 'someoneelse@example.org' } });
+ $mech->content_contains('Email alert created');
+
+ $user = FixMyStreet::DB->resultset('User')->find({ email => 'someoneelse@example.org' });
+ ok $user, 'user created for alert';
+
+ $alert = FixMyStreet::DB->resultset('Alert')->find({
+ user => $user,
+ alert_type => 'new_updates',
+ parameter => $report->id,
+ confirmed => 1,
+ });
+ ok $alert, 'New alert created for another user';
+
+ $alert = FixMyStreet::DB->resultset('Alert')->find({
+ user => $staff_user,
+ alert_type => 'new_updates',
+ parameter => $report->id,
+ confirmed => 1,
+ });
+ is $alert, undef, 'No alert created for staff user';
+};
+
+$report->delete; # Emails sent otherwise below
+
my $gloucester = $mech->create_body_ok(2226, 'Gloucestershire County Council');
$mech->create_body_ok(2326, 'Cheltenham Borough Council');
diff --git a/templates/web/base/alert/updates.html b/templates/web/base/alert/updates.html
index 96d1c467d..0fbed2254 100644
--- a/templates/web/base/alert/updates.html
+++ b/templates/web/base/alert/updates.html
@@ -16,12 +16,24 @@
<form action="/alert/subscribe" method="post">
<fieldset>
+ [% IF c.user_exists %]
+ [% IF c.user.has_permission_to("contribute_as_another_user", problem.bodies_str_ids) %]
+ <label class="hidden n" for="alert_rznvy">[% loc('Email') %]</label>
+ <div class="form-txt-submit-box">
+ <input class="form-control" type="email" name="rznvy" id="alert_rznvy" value="[% email | html %]">
+ <input class="green-btn" type="submit" value="[% loc('Subscribe') %]">
+ </div>
+ [% ELSE %]
+ <input class="green-btn" type="submit" name="alert" value="[% loc('Subscribe') %]">
+ [% END %]
+ [% ELSE %]
<label class="hidden n" for="alert_rznvy">[% loc('Your email') %]</label>
<div class="form-txt-submit-box">
<input class="form-control" type="email" name="rznvy" id="alert_rznvy" value="[% email | html %]">
<input class="green-btn" type="submit" value="[% loc('Subscribe') %]">
</div>
+ [% END %]
<input type="hidden" name="token" value="[% csrf_token %]">
<input type="hidden" name="id" value="[% problem.id | html %]">
diff --git a/templates/web/base/report/display_tools.html b/templates/web/base/report/display_tools.html
index ea12ab707..4f6031ec5 100644
--- a/templates/web/base/report/display_tools.html
+++ b/templates/web/base/report/display_tools.html
@@ -44,7 +44,15 @@
[% loc('Receive email when updates are left on this problem.' ) %]</p>
<fieldset>
[% IF c.user_exists %]
- <input class="green-btn" type="submit" name="alert" value="[% loc('Subscribe') %]">
+ [% IF c.user.has_permission_to("contribute_as_another_user", problem.bodies_str_ids) %]
+ <label for="alert_rznvy">[% loc('Email') %]</label>
+ <div class="form-txt-submit-box">
+ <input type="email" class="form-control" name="rznvy" id="alert_rznvy" value="[% email | html %]" size="30">
+ <input class="green-btn" type="submit" name="alert" value="[% loc('Subscribe') %]">
+ </div>
+ [% ELSE %]
+ <input class="green-btn" type="submit" name="alert" value="[% loc('Subscribe') %]">
+ [% END %]
[% ELSE %]
<label for="alert_rznvy">[% loc('Your email') %]</label>
<div class="form-txt-submit-box">
diff --git a/templates/web/base/report/new/duplicate_suggestions.html b/templates/web/base/report/new/duplicate_suggestions.html
index 991c8d5e8..bd86eb883 100644
--- a/templates/web/base/report/new/duplicate_suggestions.html
+++ b/templates/web/base/report/new/duplicate_suggestions.html
@@ -29,7 +29,15 @@
<input type="hidden" name="token" value="[% csrf_token %]" disabled>
<input type="hidden" name="type" value="updates" disabled>
[% IF c.user_exists %]
- <input type="submit" value="[% loc('Get updates') %]" class="btn btn--block" id="alert_email_button">
+ [% IF c.user.has_permission_to('contribute_as_another_user', bodies_ids) %]
+ <label for="rznvy_input">[% loc('Email') %]</label>
+ <div class="form-txt-submit-box">
+ <input type="email" class="form-control" name="rznvy" id="rznvy_input" aria-described-by="rznvy_hint" disabled>
+ <input type="submit" value="[% loc('Get updates') %]" class="btn" id="alert_email_button">
+ </div>
+ [% ELSE %]
+ <input type="submit" value="[% loc('Get updates') %]" class="btn btn--block" id="alert_email_button">
+ [% END %]
[% ELSE %]
<label for="rznvy_input">[% loc('Your email') %]</label>
<div class="form-txt-submit-box">
generated by cgit v1.2.3 (git 2.25.1) at 2025-07-20 08:59:15 +0000