jjsm01/kimai2
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

improve permissison handling in invoice screen (#2965)

Browse Source
This commit is contained in:
Kevin Papst
2021-11-21 16:41:03 +01:00
committed by GitHub
parent 76e09447c8
commit ff9acab0fc
15 changed files with 183 additions and 124 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
tests/Controller/InvoiceControllerTest.php
View File

@@ -207,7 +207,7 @@ class InvoiceControllerTest extends ControllerBaseTest
}
}
public function testPrintAction()
public function testPreviewAction()
{
$client = $this->getClientForAuthenticatedUser(User::ROLE_TEAMLEAD);
@@ -233,9 +233,11 @@ class InvoiceControllerTest extends ControllerBaseTest
$params = [
'daterange' => $dateRange,
'projects' => [1],
'template' => $id,
'customers[]' => 1
];
$action = '/invoice/preview/1/' . $id . '?' . http_build_query($params);
$action = '/invoice/preview/1?' . http_build_query($params);
$this->request($client, $action);
$this->assertTrue($client->getResponse()->isSuccessful());
$node = $client->getCrawler()->filter('body');
@@ -243,7 +245,7 @@ class InvoiceControllerTest extends ControllerBaseTest
$this->assertEquals('invoice_print', $node->getIterator()[0]->getAttribute('class'));
}
public function testCreateActionAsAdminWithDownloadAndStatusChangeAndDelete()
public function testCreateActionAsAdminWithDownloadAndStatusChange()
{
$client = $this->getClientForAuthenticatedUser(User::ROLE_ADMIN);
@@ -352,12 +354,6 @@ class InvoiceControllerTest extends ControllerBaseTest
$this->assertIsRedirect($client, '/invoice/show');
$client->followRedirect();
$this->assertTrue($client->getResponse()->isSuccessful());
// this does not delete the invoice, because the token is wrong
$this->request($client, '/invoice/delete/' . $id . '/fghfkjhgkjhg');
$this->assertIsRedirect($client, '/invoice/show');
$client->followRedirect();
$this->assertTrue($client->getResponse()->isSuccessful());
}
public function testEditTemplateAction()

3
tests/Repository/Query/CustomerFormTypeQueryTest.php
View File

@@ -25,6 +25,9 @@ class CustomerFormTypeQueryTest extends BaseFormTypeQueryTest
$this->assertBaseQuery($sut);
$customer = new Customer();
self::assertFalse($sut->isAllowCustomerPreselect());
$sut->setAllowCustomerPreselect(true);
self::assertTrue($sut->isAllowCustomerPreselect());
self::assertNull($sut->getCustomerToIgnore());
self::assertInstanceOf(CustomerFormTypeQuery::class, $sut->setCustomerToIgnore($customer));
self::assertSame($customer, $sut->getCustomerToIgnore());

46
tests/Voter/CustomerVoterTest.php
View File

@@ -118,4 +118,50 @@ class CustomerVoterTest extends AbstractVoterTest
$this->assertVote($user, $customer, 'edit', VoterInterface::ACCESS_GRANTED);
}
public function testAccess()
{
// ALLOW: customer has no teams
$this->assertVote(new User(), new Customer(), 'access', VoterInterface::ACCESS_GRANTED);
// ALLOW: customer has no teams
$user = new User();
$user->addTeam(new Team());
$this->assertVote($user, new Customer(), 'access', VoterInterface::ACCESS_GRANTED);
// ALLOW: user and customer are in the same team (as teamlead)
$team = new Team();
$user = new User();
$team->addTeamlead($user);
$customer = new Customer();
$customer->addTeam($team);
$this->assertVote($user, $customer, 'access', VoterInterface::ACCESS_GRANTED);
// ALLOW: user and customer are in the same team (as member)
$team = new Team();
$user = new User();
$user->addTeam(new Team());
$user->addTeam($team);
$customer = new Customer();
$customer->addTeam($team);
$this->assertVote($user, $customer, 'access', VoterInterface::ACCESS_GRANTED);
// DENY: customer has a team, user not
$customer = new Customer();
$customer->addTeam(new Team());
$this->assertVote(new User(), $customer, 'access', VoterInterface::ACCESS_DENIED);
// DENY: user and customer has a team are not in the same team
$user = new User();
$user->addTeam(new Team());
$customer = new Customer();
$customer->addTeam(new Team());
$this->assertVote($user, $customer, 'access', VoterInterface::ACCESS_DENIED);
}
}