Mirrors/Dispatcharr
1
0
Fork 1
mirror of https://github.com/Dispatcharr/Dispatcharr.git synced 2026-07-17 16:50:53 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

tests: Add a check that a user can not self elevate.

Browse source
This commit is contained in:
SergeantPanda 2026-03-08 16:10:07 -05:00
parent 0070e66dd1
commit 72e4ce0813
2 changed files with 21 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

5
frontend/src/components/Sidebar.jsx
View file

@ -148,12 +148,11 @@ const Sidebar = ({ collapsed, toggleDrawer, drawerWidth, miniDrawerWidth }) => {
const closeUserForm = () => setUserFormOpen(false);
// Get user's saved navigation order and hidden items using store getters
const navOrder = getNavOrder();
const hiddenNav = getHiddenNav();
const isAdmin = authUser && authUser.user_level >= USER_LEVELS.ADMIN;
// Navigation Items - computed from user's saved order, filtered by visibility
const navOrder = getNavOrder();
const hiddenNav = getHiddenNav();
const navItems = useMemo(() => {
const orderedItems = getOrderedNavItems(navOrder, isAdmin, channels);
return orderedItems.filter((item) => !hiddenNav.includes(item.id));

23
tests/test_user_preferences.py
View file

@ -61,7 +61,7 @@ class UserPreferencesAPITests(TestCase):
self.assertEqual(response.data["custom_properties"]["navOrder"], nav_order)
def test_patch_me_partial_update_preserves_other_properties(self):
"""Test partial update doesn't overwrite other custom_properties"""
"""Test partial update merges into existing custom_properties, preserving other keys"""
# Set initial custom_properties
self.user.custom_properties = {
"theme": "dark",
@ -69,7 +69,7 @@ class UserPreferencesAPITests(TestCase):
}
self.user.save()
# Update only navOrder
# Update only navOrder - send delta, not full object
nav_order = ["channels", "vods"]
data = {
"custom_properties": {
@ -80,9 +80,10 @@ class UserPreferencesAPITests(TestCase):
response = self.client.patch(self.me_url, data, format="json")
self.assertEqual(response.status_code, status.HTTP_200_OK)
# Note: JSONField replacement behavior - the entire custom_properties is replaced
# This is expected Django behavior for JSONField
# Backend merge semantics: existing keys are preserved
self.assertEqual(response.data["custom_properties"]["navOrder"], nav_order)
self.assertEqual(response.data["custom_properties"]["theme"], "dark")
self.assertEqual(response.data["custom_properties"]["someOtherSetting"], True)
def test_patch_me_with_empty_nav_order(self):
"""Test PATCH with empty navOrder array"""
@ -125,3 +126,17 @@ class UserPreferencesAPITests(TestCase):
response = unauthenticated_client.patch(self.me_url, data, format="json")
self.assertEqual(response.status_code, status.HTTP_401_UNAUTHORIZED)
def test_patch_me_cannot_escalate_privileges(self):
"""Test PATCH /me/ rejects attempts to change user_level or is_staff"""
original_level = self.user.user_level
data = {"user_level": 99, "is_staff": True, "is_superuser": True}
response = self.client.patch(self.me_url, data, format="json")
self.assertEqual(response.status_code, status.HTTP_400_BAD_REQUEST)
self.user.refresh_from_db()
self.assertEqual(self.user.user_level, original_level)
self.assertFalse(self.user.is_staff)
self.assertFalse(self.user.is_superuser)