zydronium/google-nomulus
1
0
Fork 0
mirror of https://github.com/google/nomulus.git synced 2025-05-14 16:37:13 +02:00
Code Issues Projects Releases Packages Wiki Activity

Hide the edit/add buttons for fields the user can't update

Browse source 
Currently the /registrar-settings backend endpoint will fail to update any
OWNER fields that a non-OWNER tries to change.

However, the front-end (soy, js) still allow non-OWNERs to try and change
these fields (there's the "edit" or "add" button, and it only fails when you try to "save")

This CL changes the front-end to remove the ability for non-OWNERs to even try
and change these fields. However, it will still let them *view* these fields as
it has interesting and important information.

-------------------------------

In addition - it changes the webdriver tests to include the "edit buttons". Those were never tested before, and now we will test to see if they are indeed displayed or not.

-------------
Created by MOE: https://github.com/google/moe
MOE_MIGRATED_REVID=223845883
This commit is contained in:
guyben 2018-12-03 12:51:37 -08:00 • committed by jianglai
parent f980a25b32
commit a3a60075a0
19 changed files with 118 additions and 74 deletions
Download patch file Download diff file Expand all files Collapse all files

2
java/google/registry/ui/server/registrar/ConsoleUiAction.java
View file

@ -17,6 +17,7 @@ package google.registry.ui.server.registrar;
import static com.google.common.net.HttpHeaders.LOCATION;
import static com.google.common.net.HttpHeaders.X_FRAME_OPTIONS;
import static google.registry.request.auth.AuthenticatedRegistrarAccessor.Role.ADMIN;
import static google.registry.request.auth.AuthenticatedRegistrarAccessor.Role.OWNER;
import static google.registry.ui.server.registrar.RegistrarConsoleModule.PARAM_CLIENT_ID;
import static javax.servlet.http.HttpServletResponse.SC_FORBIDDEN;
import static javax.servlet.http.HttpServletResponse.SC_MOVED_TEMPORARILY;
@ -141,6 +142,7 @@ public final class ConsoleUiAction implements Runnable {
try {
clientId = paramClientId.orElse(registrarAccessor.guessClientId());
data.put("clientId", clientId);
data.put("isOwner", roleMap.containsEntry(clientId, OWNER));
data.put("isAdmin", roleMap.containsEntry(clientId, ADMIN));
// We want to load the registrar even if we won't use it later (even if we remove the