diff --git a/umap/models.py b/umap/models.py index 11e6d667..b77f2394 100644 --- a/umap/models.py +++ b/umap/models.py @@ -110,6 +110,7 @@ class Map(NamedModel): PUBLIC = 1 OPEN = 2 PRIVATE = 3 + BLOCKED = 9 EDIT_STATUS = ( (ANONYMOUS, _('Everyone can edit')), (EDITORS, _('Only editors can edit')), @@ -119,6 +120,7 @@ class Map(NamedModel): (PUBLIC, _('everyone (public)')), (OPEN, _('anyone with link')), (PRIVATE, _('editors only')), + (BLOCKED, _('blocked')), ) slug = models.SlugField(db_index=True) description = models.TextField(blank=True, null=True, verbose_name=_("description")) @@ -182,7 +184,9 @@ class Map(NamedModel): return can def can_view(self, request): - if self.owner is None: + if self.share_status == self.BLOCKED: + can = False + elif self.owner is None: can = True elif self.share_status in [self.PUBLIC, self.OPEN]: can = True diff --git a/umap/tests/test_map_views.py b/umap/tests/test_map_views.py index c14ee14d..a33f9996 100644 --- a/umap/tests/test_map_views.py +++ b/umap/tests/test_map_views.py @@ -265,6 +265,23 @@ def test_editors_can_access_map_with_share_status_private(client, map, user): assert response.status_code == 200 +def test_anonymous_cannot_access_map_with_share_status_blocked(client, map): + url = reverse('map', args=(map.slug, map.pk)) + map.share_status = map.BLOCKED + map.save() + response = client.get(url) + assert response.status_code == 403 + + +def test_owner_cannot_access_map_with_share_status_blocked(client, map): + url = reverse('map', args=(map.slug, map.pk)) + map.share_status = map.BLOCKED + map.save() + client.login(username=map.owner.username, password="123123") + response = client.get(url) + assert response.status_code == 403 + + def test_non_editor_cannot_access_map_if_share_status_private(client, map, user): # noqa url = reverse('map', args=(map.slug, map.pk)) map.share_status = map.PRIVATE diff --git a/umap/views.py b/umap/views.py index a1cf8eed..344db789 100644 --- a/umap/views.py +++ b/umap/views.py @@ -369,7 +369,7 @@ class MapDetailMixin: 'licences': dict((l.name, l.json) for l in Licence.objects.all()), 'edit_statuses': [(i, str(label)) for i, label in Map.EDIT_STATUS], 'share_statuses': [(i, str(label)) - for i, label in Map.SHARE_STATUS], + for i, label in Map.SHARE_STATUS if i != Map.BLOCKED], 'anonymous_edit_statuses': [(i, str(label)) for i, label in AnonymousMapPermissionsForm.STATUS], }