Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Incorrect Error for Add an Update to Unpublished Project #39

Closed
adriancollier opened this issue Jun 25, 2012 · 13 comments
Closed

Incorrect Error for Add an Update to Unpublished Project #39

adriancollier opened this issue Jun 25, 2012 · 13 comments
Assignees
@kardan
Labels
Bug Type: Permissions
Milestone
2.1.1 Jujube

Comments

@adriancollier
Copy link
Contributor

If you try to add an update to a project which is not published, you are told that you can only add updates to projects which you are linked to:

https://www.dropbox.com/s/9w2eaqw1neubbfk/Screen%20Shot%202012-06-25%20at%2016.02.36%20PM.png

This should be changed to something more accurate: "You can post updates to this project as it is not published yet" or something more generic: "This project is currently not accepting updates - please contact your Organisation Administrator for details".
@kardan
Copy link
Contributor

kardan commented Jun 27, 2012

The issue is that we are using the same error message for all non valid update attempts. This should be able to be changed with the new Django 1.4 custom error handlers. We should have different errors for "not connected" & not published

@ghost ghost assigned kardan Aug 20, 2012
kardan added a commit that referenced this issue Aug 20, 2012
@kardan
Changed wording on access denied page to mention project publish status
7d86089 
At the moment the project.connected_to_user also handles the published
verification status. We should probably just throw 404s for all
unpublished project pages and remove the check in connected_to user().

. #39
@kardan
Copy link
Contributor

kardan commented Aug 20, 2012

We should consider to throw 404s on all non published project pages. It's feels very odd that non published projects still can be seen if you know the url.

@adriancollier
Copy link
Contributor Author

Confirmed by the Partner Team:

They often send field partners the link for them to preview and advise on changes that need to be made to projects.
At the moment these partners are generally not registered users of Akvo.
If we want to remove this option and only allow the URLs to be viewed by people within the project (connected to any organisation linked to the project), then this is acceptable and we can change the process.
The partner team need notice (at least 2 weeks) before this is implemented so that their processes can be amended.
At this time they will also need to understand exactly how this is going to work.

So conclusion:

We should look at only allowing the URLs for unpublished projects to be viewable by logged in linked users - but once we know exactly how this works, we need to feedback to Partner Team along with release date for their process changes to be implemented.

@adriancollier
Copy link
Contributor Author

Addition from Thomas: Error should probably be 550 instead. Permission denied.

@kardan
Copy link
Contributor

kardan commented Aug 20, 2012

I guess he was thinking about a 403, but get the point. Django 1.4s custom error handlers enables us to provide more fine grained http errors. We should honour the http codes as much as possible, it will make it easier to in the future hook up caches or http accelerators.

kardan added a commit that referenced this issue Aug 21, 2012
@kardan
First cut on a working version for partner sites
a82c538 
- Removed the published status check out from project.connected_to_user()
- Added a draft notice at the top for a users own unpublished projects

. #39
kardan added a commit that referenced this issue Aug 22, 2012
@kardan
Cleaned up syntax to make logic a bit easier to read
195cffc 
. #39
kardan added a commit that referenced this issue Aug 22, 2012
@kardan
Added draft capability to normal RSR
36f8729 
. #39
@kardan
Copy link
Contributor

kardan commented Aug 22, 2012

Should this issue go into the 2.1.1 release if there is need for an extended period to inform partners of the new "draft" functionallity?

@adriancollier
Copy link
Contributor Author

I think there is enough time to inform now, even if we push to test next week, we have time to sort out procedures.

Do we know now how it will work?

@kardan
Copy link
Contributor

kardan commented Aug 22, 2012

Works like this:
Published projects can be seen by anyone.
A user can see own unpublished projects in "draft" state (a red banner on the top - should probably be redesigned)
A signed in user gets a permission denied (403) on non published projects
Any non user will get a not found (404) on non published projects

I still need to make a custom error message for the issue that started this change - better message in add update. Got a bit side tracked by the "draft" feature :-)

kardan added a commit that referenced this issue Aug 27, 2012
@kardan
Collection of fixes around privileges, http error codes
0d7f887 
- Projects can now be seen in draft mode for users with the correct privileges
- Projectupdate form now generates better error messages and correct http status
- Fixed add update form UI issue and made some syntax cleaning
. #39
Fix #83
kardan added a commit that referenced this issue Aug 28, 2012
@kardan
Proper checks for partner sites add updates
7d4ad70 
. #39
kardan added a commit that referenced this issue Sep 5, 2012
@kardan
Fixed bug in the Forbidden view on normal RSR
9868eec 
. #39
@kardan kardan closed this as completed in e8ae746 Sep 5, 2012
@adriancollier
Copy link
Contributor Author

Received a 403 error on http://test.akvo.org/rsr/project/588/ when not logged in - should be a 404 according to the above.

Awaiting testing for the signed in user, problem with the API key requirement from Tasypie authentication changes.

@adriancollier adriancollier reopened this Sep 6, 2012
@kardan
Copy link
Contributor

kardan commented Sep 10, 2012

Unpublished & not connected or not signed in I get a 404 at http://test.akvo.org/rsr/project/588/. Are you sure you're not signed in (signing in to the admin will sign you in to the main site - so it's easy to get confused when changing publishing states in the admin)?

I did get a 403 when signed in and not connected to the project. Maybe both cases should be a 403 to be strict about http codes. Not really sure to be honest.

@adriancollier
Copy link
Contributor Author

Yup - you're right - I did sign out of the admin for this, but it turns out I signed out of the live admin and not the test one....

@adriancollier
Copy link
Contributor Author

This developed feature is in multiple parts.

A change has been made to make unpublished projects in RSR only visible to those who are logged in to RSR AND are connected to the project. This moves the functionality in line with what most people expect - unpublished means that it is not public.

If you are not logged into RSR at all, then when you view an unpublished project such as project 599 then you are presented with a 404 Error - page does not exist.

If you are logged into RSR, but are not connected to the project then you are presented with a 403 Error - forbidden access.

If you are logged in and connected to an unpublished project, then you are able to access the page, but this displays clearly that the project is not live.

@adriancollier
Copy link
Contributor Author

Addition:

If you try to add an update to an unpublished project that you are connected to, you receive the 403 Error - forbidden access. This is correct functionality - further customisation of error messages is not simple, and not needed now.

@adriancollier adriancollier mentioned this issue Sep 17, 2012
Closed
@lauraroverts lauraroverts mentioned this issue Jan 6, 2016
Closed
@MichaelAkvo MichaelAkvo moved this to Done in RSR Dec 8, 2022
@MichaelAkvo MichaelAkvo added this to RSR Dec 8, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@kardan kardan

Labels
Bug Type: Permissions
Projects
RSR
Archived in project
Milestone
2.1.1 Jujube
Development

No branches or pull requests
2 participants
@kardan @adriancollier