diff --git a/CHANGELOG.rst b/CHANGELOG.rst index 75c18ce6da0b926559dd30f49d8f4c9a1f8fc474..8af89154dd1438a738646e5ee015292fa317b460 100644 --- a/CHANGELOG.rst +++ b/CHANGELOG.rst @@ -25,6 +25,7 @@ Fixed ~~~~~ * Changing the favicon did not result in all icons being replaced in some cases +* Superusers with a dummy person were able to access the dashboard edit page. * GroupManager.get_queryset() returned an incomplete QuerySet * OAuth was broken by a non-semver-adhering django-oauth-toolkit update * Too long texts in chips didn't result in a larger chip. diff --git a/aleksis/core/templates/core/index.html b/aleksis/core/templates/core/index.html index b3748afac207f828235a7b99715ba98795ccf609..7c9c018ca8102172dbd6e46c41048bcbcff4d46f 100644 --- a/aleksis/core/templates/core/index.html +++ b/aleksis/core/templates/core/index.html @@ -10,7 +10,7 @@ {% block content %} {% has_perm "core.edit_dashboard_rule" user as can_edit_dashboard %} - {% if can_edit_dashboard %} + {% if can_edit_dashboard and show_edit_dashboard_button %} <div class="row no-margin"> <a class="btn-flat waves-effect waves-light right" href="{% url "edit_dashboard" %}"> <i class="material-icons left">edit</i> diff --git a/aleksis/core/views.py b/aleksis/core/views.py index 33af719a6a2dd22471740b2dc5dbc4ab357293bd..45167450e83746e97bb65c4027238676c098b1c8 100644 --- a/aleksis/core/views.py +++ b/aleksis/core/views.py @@ -232,9 +232,11 @@ def index(request: HttpRequest) -> HttpResponse: context["default_dashboard"] = True media = DashboardWidget.get_media(widgets) + show_edit_dashboard_button = not getattr(person, "is_dummy", False) context["widgets"] = widgets context["media"] = media + context["show_edit_dashboard_button"] = show_edit_dashboard_button return render(request, "core/index.html", context) @@ -993,7 +995,11 @@ class EditDashboardView(PermissionRequiredMixin, View): context = {} self.default_dashboard = kwargs.get("default", False) - if self.default_dashboard and not request.user.has_perm("core.edit_default_dashboard_rule"): + if ( + self.default_dashboard + and not request.user.has_perm("core.edit_default_dashboard_rule") + or getattr(person, "is_dummy", False) + ): raise PermissionDenied() context["default_dashboard"] = self.default_dashboard