Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Iss2205 #2355

Open
wants to merge 2 commits into
base: main
Choose a base branch
from
Open

Iss2205 #2355

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
e07c4e4
added check whether user has staff permission in middleware
ybrnr Aug 5, 2024
9a6e6e7
removed old print statement meant for debugging
ybrnr Nov 25, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions evap/staff/staff_mode.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,6 +52,9 @@


def update_staff_mode(request):
if not request.user.has_staff_permission:
exit_staff_mode(request)
return

Check warning on line 57 in evap/staff/staff_mode.py

View check run for this annotation

Codecov / codecov/patch

evap/staff/staff_mode.py#L56-L57 

Added lines #L56 - L57 were not covered by tests
assert request.user.has_staff_permission
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this assertion is no longer needed

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'd move it up to line 33, where I think it would still add value.

The call graphs we can get now are a bit wonky. We can have
enter_staff_mode -> update_staff_mode -> finds out that not request.user.has_staff_permission -> exit_staff_mode and returns without exception, which is probably never what the initial caller intended?

It seems to me that update_staff_mode was about "update the timestamp in the session to now()" in the past, now it has changed semantics. Could use a little clean up in general, I think.


request.session["staff_mode_start_time"] = time.time()
Expand Down
Loading