Skip to content

Commit 8d3949d

Browse files
devGregAdevGregA
committed
feat(authorization): strip Global Role + profile Groups panel under legacy
Both profile.html (the user's own profile) and add_user.html (used for both add_user and edit_user) rendered the RBAC Global Role fieldset with a role dropdown — meaningless under legacy authorization where access is membership-based and is_staff/is_superuser are the equivalents of elevated roles. profile.html also rendered a Groups panel driven by Dojo_Group_Member, also inert under legacy. Strip both surfaces from OS in both UI trees and replace with empty {% block global_role_form %}{% endblock %} and {% block profile_groups_panel %}{% endblock %} hooks. Pro overrides both blocks at pro/templates/dojo/profile.html and pro/templates/dojo/add_user.html to re-render them under RBAC.
1 parent 1c2e5c8 commit 8d3949d

4 files changed

Lines changed: 6 additions & 122 deletions

File tree

‎dojo/templates/dojo/add_user.html‎

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -15,10 +15,7 @@ <h3> {{ name }} {% if to_edit %}- {{ to_edit.username }}{% endif %}</h3>
1515
<legend>{% trans "Additional Contact Information" %}</legend>
1616
{% include "dojo/form_fields.html" with form=contact_form %}
1717
</fieldset>
18-
<fieldset>
19-
<legend>{% trans "Global Role" %}</legend>
20-
{% include "dojo/form_fields.html" with form=global_role_form %}
21-
</fieldset>
18+
{% block global_role_form %}{% endblock %}
2219
<div class="form-group">
2320
<div class="col-sm-offset-2 col-sm-10">
2421
<input class="btn btn-primary" type="submit" name="add_user" value="{% trans "Submit" %}"/>

‎dojo/templates/dojo/profile.html‎

Lines changed: 2 additions & 57 deletions
Original file line numberDiff line numberDiff line change
@@ -15,10 +15,7 @@ <h3>{% blocktrans with full_name=user.get_full_name %} User Profile - {{ full_na
1515
<legend>{% trans "Additional Contact Information" %}</legend>
1616
{% include "dojo/form_fields.html" with form=contact_form %}
1717
</fieldset>
18-
<fieldset>
19-
<legend>{% trans "Global Role" %}</legend>
20-
{% include "dojo/form_fields.html" with form=global_role_form %}
21-
</fieldset>
18+
{% block global_role_form %}{% endblock %}
2219
<div class="form-group">
2320
<div class="col-sm-offset-2 col-sm-10">
2421
<input class="btn btn-primary" type="submit" value="{% trans "Submit" %}"/>
@@ -41,59 +38,7 @@ <h3>{% blocktrans with full_name=user.get_full_name %} User Profile - {{ full_na
4138
{% endif %}
4239
</div>
4340
</div>
44-
<div class="panel panel-default">
45-
<div class="panel-heading">
46-
<div class="clearfix">
47-
<h4 class="pull-left">{% trans "Groups" %}</h4>
48-
&nbsp;
49-
<a href="https://docs.defectdojo.com/en/customize_dojo/user_management/about_perms_and_roles/#group-memberships" target="_blank">
50-
<i class="fa-solid fa-circle-question"></i></a>
51-
{% if request.user.is_superuser %}
52-
<div class="dropdown pull-right">
53-
<button class="btn btn-primary dropdown-toggle" aria-label="Actions" type="button" id="dropdownMenuAddGroupMember"
54-
data-toggle="dropdown" aria-expanded="true">
55-
<span class="fa-solid fa-bars"></span>
56-
<span class="caret"></span>
57-
</button>
58-
<ul class="dropdown-menu dropdown-menu-right" role="menu" aria-labelledby="dropdownMenu4">
59-
<li role="presentation">
60-
<a id="addGroupMember" href="{% url 'add_group_member_user' user.id %}">
61-
<i class="fa-solid fa-plus"></i>{% trans "Add Groups" %}
62-
</a>
63-
</li>
64-
</ul>
65-
</div>
66-
{% endif %}
67-
</div>
68-
</div>
69-
{% if group_members %}
70-
<div class="table-responsive">
71-
<table class="tablesorter-bootstrap table table-condensed table-striped">
72-
<thead>
73-
<tr>
74-
<th></th>
75-
<th>{% trans "Group" %}</th>
76-
<th>{% trans "Group role" %}</th>
77-
</tr>
78-
</thead>
79-
<tbody>
80-
{% for member in group_members %}
81-
<tr>
82-
<td>
83-
</td>
84-
<td name="group_name"><a href="{% url 'view_group' member.group.id %}">{{ member.group }}</a></td>
85-
<td name="group_role">{{ member.role }}</td>
86-
</tr>
87-
{% endfor %}
88-
</tbody>
89-
</table>
90-
</div>
91-
{% else %}
92-
<div class="panel-body">
93-
<small class="text-muted"><em>{% trans "No group members found." %}</em></small>
94-
</div>
95-
{% endif %}
96-
</div>
41+
{% block profile_groups_panel %}{% endblock %}
9742
</div>
9843
</div>
9944
{% endblock %}

‎dojo/templates_classic/dojo/add_user.html‎

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -15,10 +15,7 @@ <h3> {{ name }} {% if to_edit %}- {{ to_edit.username }}{% endif %}</h3>
1515
<legend>{% trans "Additional Contact Information" %}</legend>
1616
{% include "dojo/form_fields.html" with form=contact_form %}
1717
</fieldset>
18-
<fieldset>
19-
<legend>{% trans "Global Role" %}</legend>
20-
{% include "dojo/form_fields.html" with form=global_role_form %}
21-
</fieldset>
18+
{% block global_role_form %}{% endblock %}
2219
<div class="form-group">
2320
<div class="col-sm-offset-2 col-sm-10">
2421
<input class="btn btn-primary" type="submit" name="add_user" value="{% trans "Submit" %}"/>

‎dojo/templates_classic/dojo/profile.html‎

Lines changed: 2 additions & 57 deletions
Original file line numberDiff line numberDiff line change
@@ -15,10 +15,7 @@ <h3>{% blocktrans with full_name=user.get_full_name %} User Profile - {{ full_na
1515
<legend>{% trans "Additional Contact Information" %}</legend>
1616
{% include "dojo/form_fields.html" with form=contact_form %}
1717
</fieldset>
18-
<fieldset>
19-
<legend>{% trans "Global Role" %}</legend>
20-
{% include "dojo/form_fields.html" with form=global_role_form %}
21-
</fieldset>
18+
{% block global_role_form %}{% endblock %}
2219
<div class="form-group">
2320
<div class="col-sm-offset-2 col-sm-10">
2421
<input class="btn btn-primary" type="submit" value="{% trans "Submit" %}"/>
@@ -41,59 +38,7 @@ <h3>{% blocktrans with full_name=user.get_full_name %} User Profile - {{ full_na
4138
{% endif %}
4239
</div>
4340
</div>
44-
<div class="panel panel-default">
45-
<div class="panel-heading">
46-
<div class="clearfix">
47-
<h4 class="pull-left">{% trans "Groups" %}</h4>
48-
&nbsp;
49-
<a href="https://docs.defectdojo.com/en/customize_dojo/user_management/about_perms_and_roles/#group-memberships" target="_blank">
50-
<i class="fa-solid fa-circle-question"></i></a>
51-
{% if request.user.is_superuser %}
52-
<div class="dropdown pull-right">
53-
<button class="btn btn-primary dropdown-toggle" aria-label="Actions" type="button" id="dropdownMenuAddGroupMember"
54-
data-toggle="dropdown" aria-expanded="true">
55-
<span class="fa-solid fa-bars"></span>
56-
<span class="caret"></span>
57-
</button>
58-
<ul class="dropdown-menu dropdown-menu-right" role="menu" aria-labelledby="dropdownMenu4">
59-
<li role="presentation">
60-
<a id="addGroupMember" href="{% url 'add_group_member_user' user.id %}">
61-
<i class="fa-solid fa-plus"></i>{% trans "Add Groups" %}
62-
</a>
63-
</li>
64-
</ul>
65-
</div>
66-
{% endif %}
67-
</div>
68-
</div>
69-
{% if group_members %}
70-
<div class="table-responsive">
71-
<table class="tablesorter-bootstrap table table-condensed table-striped">
72-
<thead>
73-
<tr>
74-
<th></th>
75-
<th>{% trans "Group" %}</th>
76-
<th>{% trans "Group role" %}</th>
77-
</tr>
78-
</thead>
79-
<tbody>
80-
{% for member in group_members %}
81-
<tr>
82-
<td>
83-
</td>
84-
<td name="group_name"><a href="{% url 'view_group' member.group.id %}">{{ member.group }}</a></td>
85-
<td name="group_role">{{ member.role }}</td>
86-
</tr>
87-
{% endfor %}
88-
</tbody>
89-
</table>
90-
</div>
91-
{% else %}
92-
<div class="panel-body">
93-
<small class="text-muted"><em>{% trans "No group members found." %}</em></small>
94-
</div>
95-
{% endif %}
96-
</div>
41+
{% block profile_groups_panel %}{% endblock %}
9742
</div>
9843
</div>
9944
{% endblock %}

0 commit comments

Comments
 (0)