aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--CHANGELOG.md1
-rw-r--r--perllib/FixMyStreet/App/Controller/Alert.pm43
-rw-r--r--perllib/FixMyStreet/App/Controller/Report.pm4
-rw-r--r--t/app/controller/alert_new.t66
-rw-r--r--templates/web/base/alert/updates.html16
-rw-r--r--templates/web/base/report/display_tools.html10
-rw-r--r--templates/web/base/report/new/duplicate_suggestions.html10
7 files changed, 109 insertions, 41 deletions
diff --git a/CHANGELOG.md b/CHANGELOG.md
index f9bb0b2e0..01c7a46b9 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -32,6 +32,7 @@
- Store a moderation history on admin report edit.
- Add user admin log page.
- Allow report as another user with only name.
+ - Allow staff users to sign other people up for alerts.
- New features:
- Categories can be listed under more than one group #2475
- OpenID Connect login support. #2523
diff --git a/perllib/FixMyStreet/App/Controller/Alert.pm b/perllib/FixMyStreet/App/Controller/Alert.pm
index 755602562..a42e7203a 100644
--- a/perllib/FixMyStreet/App/Controller/Alert.pm
+++ b/perllib/FixMyStreet/App/Controller/Alert.pm
@@ -58,12 +58,15 @@ sub subscribe : Path('subscribe') : Args(0) {
$c->detach('rss') if $c->get_param('rss');
+ my $id = $c->get_param('id');
+ $c->forward('/report/load_problem_or_display_error', [ $id ]) if $id;
+
# if it exists then it's been submitted so we should
# go to subscribe email and let it work out the next step
$c->detach('subscribe_email')
if $c->get_param('rznvy') || $c->get_param('alert');
- $c->go('updates') if $c->get_param('id');
+ $c->go('updates') if $id;
# shouldn't get to here but if we have then do something sensible
$c->go('index');
@@ -148,7 +151,7 @@ sub updates : Path('updates') : Args(0) {
$c->forward('/auth/get_csrf_token');
$c->stash->{email} = $c->get_param('rznvy');
- $c->stash->{problem_id} = $c->get_param('id');
+ $c->stash->{email} ||= $c->user->email if $c->user_exists;
}
=head2 confirm
@@ -193,7 +196,7 @@ sub create_alert : Private {
$alert->insert();
}
- if ( $c->user && $c->user->id == $alert->user->id ) {
+ if ( $c->user_exists && ($c->user->id == $alert->user->id || $c->stash->{can_create_for_another})) {
$alert->confirm();
} else {
$alert->confirmed(0);
@@ -211,13 +214,10 @@ Set up the options in the stash required to create a problem update alert
sub set_update_alert_options : Private {
my ( $self, $c ) = @_;
- my $report_id = $c->get_param('id');
- return unless $report_id =~ /^[1-9]\d*$/;
-
my $options = {
user => $c->stash->{alert_user},
alert_type => 'new_updates',
- parameter => $report_id,
+ parameter => $c->stash->{problem}->id,
};
$c->stash->{alert_options} = $options;
@@ -340,16 +340,16 @@ sub process_user : Private {
my ( $self, $c ) = @_;
if ( $c->user_exists ) {
- $c->stash->{alert_user} = $c->user->obj;
- return;
+ $c->stash->{can_create_for_another} = $c->stash->{problem}
+ && $c->user->has_permission_to(contribute_as_another_user => $c->stash->{problem}->bodies_str_ids);
+ if (!$c->stash->{can_create_for_another}) {
+ $c->stash->{alert_user} = $c->user->obj;
+ return;
+ }
}
- # Extract all the params to a hash to make them easier to work with
- my %params = map { $_ => $c->get_param($_) }
- ( 'rznvy' ); # , 'password_register' );
-
- # cleanup the email address
- my $email = $params{rznvy} ? lc $params{rznvy} : '';
+ my $email = $c->get_param('rznvy');
+ $email = $email ? lc $email : '';
$email =~ s{\s+}{}g;
push @{ $c->stash->{errors} }, _('Please enter a valid email address')
@@ -357,19 +357,6 @@ sub process_user : Private {
my $alert_user = $c->model('DB::User')->find_or_new( { email => $email } );
$c->stash->{alert_user} = $alert_user;
-
-# # The user is trying to sign in. We only care about email from the params.
-# if ( $c->get_param('submit_sign_in') ) {
-# unless ( $c->forward( '/auth/sign_in', [ $email ] ) ) {
-# $c->stash->{field_errors}->{password} = _('There was a problem with your email/password combination. Please try again.');
-# return 1;
-# }
-# my $user = $c->user->obj;
-# $c->stash->{alert_user} = $user;
-# return 1;
-# }
-#
-# $alert_user->password( $params{password_register} );
}
=head2 setup_coordinate_rss_feeds
diff --git a/perllib/FixMyStreet/App/Controller/Report.pm b/perllib/FixMyStreet/App/Controller/Report.pm
index debf27cde..9cc810c16 100644
--- a/perllib/FixMyStreet/App/Controller/Report.pm
+++ b/perllib/FixMyStreet/App/Controller/Report.pm
@@ -91,6 +91,10 @@ sub display :PathPart('') :Chained('id') :Args(0) {
$c->stash->{template} = 'report/inspect.html';
$c->forward('inspect');
}
+
+ if ($c->user_exists && $c->user->has_permission_to(contribute_as_another_user => $c->stash->{problem}->bodies_str_ids)) {
+ $c->stash->{email} = $c->user->email;
+ }
}
sub moderate_report :PathPart('moderate') :Chained('id') :Args(0) {
diff --git a/t/app/controller/alert_new.t b/t/app/controller/alert_new.t
index ed2bc814c..7eba90530 100644
--- a/t/app/controller/alert_new.t
+++ b/t/app/controller/alert_new.t
@@ -6,6 +6,9 @@ my $mech = FixMyStreet::TestMech->new;
my $user = FixMyStreet::App->model('DB::User')
->new( { email => 'test@example.com' } );
+my $body = $mech->create_body_ok(2651, 'Edinburgh Council');
+my ($report) = $mech->create_problems_for_body(1, $body->id, 'Existing');
+
foreach my $test (
{
email => $user->email,
@@ -51,8 +54,8 @@ foreach my $test (
type => 'new_updates',
content => 'Click the link in our confirmation email to activate your alert',
email_text => "confirms that you'd like to receive an email",
- uri => '/alert/subscribe?type=updates&rznvy=' . $user->email . '&id=1',
- param1 => 1,
+ uri => '/alert/subscribe?type=updates&rznvy=' . $user->email . '&id=' . $report->id,
+ param1 => $report->id,
}
)
{
@@ -61,7 +64,7 @@ foreach my $test (
my $type = $test->{type};
- $mech->get_ok('/alert/subscribe?id=1');
+ $mech->get_ok('/alert/subscribe?id=' . $report->id);
my ($csrf) = $mech->content =~ /name="token" value="([^"]*)"/;
$mech->get_ok( $test->{uri} . "&token=$csrf" );
@@ -155,7 +158,7 @@ foreach my $test (
# clear existing data so we can be sure we're creating it
ok $alert->delete() if $alert && !$test->{exist};
- $mech->get_ok('/alert/subscribe?id=1');
+ $mech->get_ok('/alert/subscribe?id=' . $report->id);
my ($csrf) = $mech->content =~ /name="token" value="([^"]*)"/;
$mech->get_ok( '/alert/subscribe?type=local&rznvy=' . $user->email . '&feed=area:1000:A_Location&token=' . $csrf );
@@ -179,8 +182,6 @@ foreach my $test (
};
}
-my $body = $mech->create_body_ok(2651, 'Edinburgh Council');
-
foreach my $test (
{
desc => 'logged in user signing up',
@@ -231,8 +232,8 @@ for my $test (
type => 'new_updates',
content => 'Click the link in our confirmation email to activate your alert',
email_text => 'confirm the alert',
- uri => '/alert/subscribe?type=updates&rznvy=' . $user->email . '&id=1',
- param1 => 1,
+ uri => '/alert/subscribe?type=updates&rznvy=' . $user->email . '&id=' . $report->id,
+ param1 => $report->id,
}
)
{
@@ -255,7 +256,7 @@ for my $test (
FixMyStreet::DB->resultset('Abuse')
->find_or_create( { email => $test->{email} } );
- $mech->get_ok('/alert/subscribe?id=1');
+ $mech->get_ok('/alert/subscribe?id=' . $report->id);
my ($csrf) = $mech->content =~ /name="token" value="([^"]*)"/;
$mech->get_ok( $test->{uri} . "&token=$csrf" );
@@ -288,6 +289,53 @@ for my $test (
};
}
+subtest 'Test body user signing someone else up for alerts' => sub {
+ my $staff_user = $mech->create_user_ok('astaffuser@example.com', name => 'A staff user', from_body => $body);
+ $mech->log_in_ok($staff_user->email);
+
+ $mech->get_ok('/alert/subscribe?id=' . $report->id);
+ my ($csrf) = $mech->content =~ /name="token" value="([^"]*)"/;
+ $mech->post_ok('/alert/subscribe', { rznvy => 'someoneelse@example.org', id => $report->id, type => 'updates', token => $csrf });
+
+ my $user = FixMyStreet::DB->resultset('User')->find({ email => 'someoneelse@example.org' });
+ is $user, undef, 'No user made by bad request';
+
+ my $alert = FixMyStreet::DB->resultset('Alert')->find({
+ user => $staff_user,
+ alert_type => 'new_updates',
+ parameter => $report->id,
+ confirmed => 1,
+ });
+ ok $alert, 'New alert created with logged in user';
+ $alert->delete;
+
+ $staff_user->user_body_permissions->create({ permission_type => 'contribute_as_another_user', body => $body });
+ $mech->get_ok('/alert/subscribe?id=' . $report->id);
+ $mech->submit_form_ok({ with_fields => { rznvy => 'someoneelse@example.org' } });
+ $mech->content_contains('Email alert created');
+
+ $user = FixMyStreet::DB->resultset('User')->find({ email => 'someoneelse@example.org' });
+ ok $user, 'user created for alert';
+
+ $alert = FixMyStreet::DB->resultset('Alert')->find({
+ user => $user,
+ alert_type => 'new_updates',
+ parameter => $report->id,
+ confirmed => 1,
+ });
+ ok $alert, 'New alert created for another user';
+
+ $alert = FixMyStreet::DB->resultset('Alert')->find({
+ user => $staff_user,
+ alert_type => 'new_updates',
+ parameter => $report->id,
+ confirmed => 1,
+ });
+ is $alert, undef, 'No alert created for staff user';
+};
+
+$report->delete; # Emails sent otherwise below
+
my $gloucester = $mech->create_body_ok(2226, 'Gloucestershire County Council');
$mech->create_body_ok(2326, 'Cheltenham Borough Council');
diff --git a/templates/web/base/alert/updates.html b/templates/web/base/alert/updates.html
index a77f8d0f9..0fbed2254 100644
--- a/templates/web/base/alert/updates.html
+++ b/templates/web/base/alert/updates.html
@@ -5,7 +5,7 @@
[% INCLUDE 'errors.html' %]
-<p><a href="[% c.uri_for( '/rss', problem_id ) %]">
+<p><a href="[% c.uri_for( '/rss', problem.id ) %]">
<img src="/i/feed.png" width="16" height="16" title="[% loc('RSS feed') %]" alt="[% loc('RSS feed of updates to this problem' ) %]" border="0" style="float:right">
</a>
</p>
@@ -16,15 +16,27 @@
<form action="/alert/subscribe" method="post">
<fieldset>
+ [% IF c.user_exists %]
+ [% IF c.user.has_permission_to("contribute_as_another_user", problem.bodies_str_ids) %]
+ <label class="hidden n" for="alert_rznvy">[% loc('Email') %]</label>
+ <div class="form-txt-submit-box">
+ <input class="form-control" type="email" name="rznvy" id="alert_rznvy" value="[% email | html %]">
+ <input class="green-btn" type="submit" value="[% loc('Subscribe') %]">
+ </div>
+ [% ELSE %]
+ <input class="green-btn" type="submit" name="alert" value="[% loc('Subscribe') %]">
+ [% END %]
+ [% ELSE %]
<label class="hidden n" for="alert_rznvy">[% loc('Your email') %]</label>
<div class="form-txt-submit-box">
<input class="form-control" type="email" name="rznvy" id="alert_rznvy" value="[% email | html %]">
<input class="green-btn" type="submit" value="[% loc('Subscribe') %]">
</div>
+ [% END %]
<input type="hidden" name="token" value="[% csrf_token %]">
- <input type="hidden" name="id" value="[% problem_id | html %]">
+ <input type="hidden" name="id" value="[% problem.id | html %]">
<input type="hidden" name="type" value="updates">
</fieldset>
</form>
diff --git a/templates/web/base/report/display_tools.html b/templates/web/base/report/display_tools.html
index ea12ab707..4f6031ec5 100644
--- a/templates/web/base/report/display_tools.html
+++ b/templates/web/base/report/display_tools.html
@@ -44,7 +44,15 @@
[% loc('Receive email when updates are left on this problem.' ) %]</p>
<fieldset>
[% IF c.user_exists %]
- <input class="green-btn" type="submit" name="alert" value="[% loc('Subscribe') %]">
+ [% IF c.user.has_permission_to("contribute_as_another_user", problem.bodies_str_ids) %]
+ <label for="alert_rznvy">[% loc('Email') %]</label>
+ <div class="form-txt-submit-box">
+ <input type="email" class="form-control" name="rznvy" id="alert_rznvy" value="[% email | html %]" size="30">
+ <input class="green-btn" type="submit" name="alert" value="[% loc('Subscribe') %]">
+ </div>
+ [% ELSE %]
+ <input class="green-btn" type="submit" name="alert" value="[% loc('Subscribe') %]">
+ [% END %]
[% ELSE %]
<label for="alert_rznvy">[% loc('Your email') %]</label>
<div class="form-txt-submit-box">
diff --git a/templates/web/base/report/new/duplicate_suggestions.html b/templates/web/base/report/new/duplicate_suggestions.html
index 991c8d5e8..bd86eb883 100644
--- a/templates/web/base/report/new/duplicate_suggestions.html
+++ b/templates/web/base/report/new/duplicate_suggestions.html
@@ -29,7 +29,15 @@
<input type="hidden" name="token" value="[% csrf_token %]" disabled>
<input type="hidden" name="type" value="updates" disabled>
[% IF c.user_exists %]
- <input type="submit" value="[% loc('Get updates') %]" class="btn btn--block" id="alert_email_button">
+ [% IF c.user.has_permission_to('contribute_as_another_user', bodies_ids) %]
+ <label for="rznvy_input">[% loc('Email') %]</label>
+ <div class="form-txt-submit-box">
+ <input type="email" class="form-control" name="rznvy" id="rznvy_input" aria-described-by="rznvy_hint" disabled>
+ <input type="submit" value="[% loc('Get updates') %]" class="btn" id="alert_email_button">
+ </div>
+ [% ELSE %]
+ <input type="submit" value="[% loc('Get updates') %]" class="btn btn--block" id="alert_email_button">
+ [% END %]
[% ELSE %]
<label for="rznvy_input">[% loc('Your email') %]</label>
<div class="form-txt-submit-box">
generated by cgit v1.2.3 (git 2.25.1) at 2025-04-26 17:34:45 +0000