Sfoglia il codice sorgente

Fix crash when loading the dashboard with only the "unlock" page permission

Unyime Emmanuel Udoh 2 mesi fa
parent
commit
d8d75bddf0

+ 2 - 1
docs/topics/permissions.md

@@ -31,7 +31,8 @@ The full set of available permission types is as follows:
 -   **Edit** - grants the ability to edit and delete this page, and any pages underneath it, regardless of ownership. A user with only 'edit' permission may not create new pages, only edit existing ones. Published pages cannot be deleted unless the user also has 'publish' permission.
 -   **Publish** - grants the ability to publish and unpublish this page and/or its children. A user without publish permission cannot directly make changes that are visible to visitors of the website; instead, they must submit their changes for moderation. Publish permission is independent of edit permission; a user with only publish permission will not be able to make any edits of their own.
 -   **Bulk delete** - allows a user to delete pages that have descendants, in a single operation. Without this permission, a user has to delete the descendant pages individually before deleting the parent. This is a safeguard against accidental deletion. This permission must be used in conjunction with 'add' / 'edit' permission, as it does not provide any deletion rights of its own; it only provides a 'shortcut' for the permissions the user has already. For example, a user with just 'add' and 'bulk delete' permissions will only be able to bulk-delete if all the affected pages are owned by that user, and are unpublished.
--   **Lock** - grants the ability to lock or unlock this page (and any pages underneath it) for editing, preventing users from making any further edits to it.
+-   **Lock** - grants the ability to lock this page (and any pages underneath it) for editing, preventing other users from making any further edits to it.
+-   **Unlock** - grants the ability to unlock this page (and any pages underneath it), even if the page was locked by another user. Without this permission, only the user who locked the page (and superusers) can unlock the page.
 
 Drafts can be viewed only if the user has either Edit or Publish permission.
 

+ 12 - 0
wagtail/admin/tests/test_site_summary.py

@@ -79,3 +79,15 @@ class TestPagesSummary(WagtailTestUtils, TestCase):
         self.user.save()
         self.user.groups.add(self.test_page_group)
         self.assertSummaryContains("1 Page")
+
+    def test_user_with_only_unlock_permission_sees_proper_page_count(self):
+        self.user.is_superuser = False
+        self.user.save()
+        test_page_group_with_only_unlock = Group.objects.create(name="Test page unlock")
+        GroupPagePermission.objects.create(
+            group=test_page_group_with_only_unlock,
+            page=self.test_page,
+            permission_type="unlock",
+        )
+        self.user.groups.add(test_page_group_with_only_unlock)
+        self.assertSummaryContains("1 Page")

+ 2 - 2
wagtail/permission_policies/pages.py

@@ -166,7 +166,7 @@ class PagePermissionPolicy(OwnershipPermissionPolicy):
             return Page.objects.filter(depth=1)
         else:
             codenames = self._get_permission_codenames(
-                {"add", "change", "publish", "lock"}
+                {"add", "change", "publish", "lock", "unlock"}
             )
             return [
                 perm.page
@@ -195,7 +195,7 @@ class PagePermissionPolicy(OwnershipPermissionPolicy):
             return base_queryset
 
         explorable_pages = self.instances_user_has_any_permission_for(
-            user, {"add", "change", "publish", "lock"}
+            user, {"add", "change", "publish", "lock", "unlock"}
         )
 
         # For all pages with specific permissions, add their ancestors as