From 9228e9be868a7ac39f4a57a9904942ac3a3c4685 Mon Sep 17 00:00:00 2001 From: Rohit Paul Kuruvilla Date: Thu, 4 Dec 2014 17:29:09 +0530 Subject: [PATCH 1/3] Don't allow teams to make receiving anonymous --- www/%username/account/index.html.spt | 2 ++ www/%username/anonymous.json.spt | 2 ++ 2 files changed, 4 insertions(+) diff --git a/www/%username/account/index.html.spt b/www/%username/account/index.html.spt index 345887b71b..425dc2abf2 100644 --- a/www/%username/account/index.html.spt +++ b/www/%username/account/index.html.spt @@ -46,11 +46,13 @@ emails = participant.get_emails() {{ _("Hide total giving from others.") }}
+ {% if participant.IS_SINGULAR %} + {% endif %}

{% if not user.ANON and (user.ADMIN or user.participant == participant) %}

{{ _("Available Money") }}

diff --git a/www/%username/anonymous.json.spt b/www/%username/anonymous.json.spt index 021e70ad9f..9c02494874 100644 --- a/www/%username/anonymous.json.spt +++ b/www/%username/anonymous.json.spt @@ -7,6 +7,8 @@ if POST: field = body.get("toggle", "giving") if field not in ["giving", "receiving"]: raise Response(400) + if user.participant.IS_PLURAL and field == "receiving": + raise Response(400) rec = website.db.one(""" UPDATE participants From 768984ac5bb5bd9f191d5b7e9efa539d18b90ac5 Mon Sep 17 00:00:00 2001 From: Rohit Paul Kuruvilla Date: Thu, 4 Dec 2014 17:41:39 +0530 Subject: [PATCH 2/3] SQL script to turn anonymous_receiving off for all organizations --- branch.sql | 3 +++ 1 file changed, 3 insertions(+) create mode 100644 branch.sql diff --git a/branch.sql b/branch.sql new file mode 100644 index 0000000000..a95a9cf014 --- /dev/null +++ b/branch.sql @@ -0,0 +1,3 @@ +BEGIN; + UPDATE participants SET anonymous_receiving=FALSE WHERE number='plural'; +END; \ No newline at end of file From 4c49b2caae6894ffff3f28e797a5a04461886907 Mon Sep 17 00:00:00 2001 From: Rohit Paul Kuruvilla Date: Sun, 14 Dec 2014 16:50:20 +0530 Subject: [PATCH 3/3] Added test --- tests/py/test_anonymous_json.py | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/tests/py/test_anonymous_json.py b/tests/py/test_anonymous_json.py index 3f78a3f58f..c5920a980d 100644 --- a/tests/py/test_anonymous_json.py +++ b/tests/py/test_anonymous_json.py @@ -32,6 +32,17 @@ def test_participant_can_toggle_anonymous_receiving(self): actual = json.loads(response.body) assert actual['receiving'] is True + def test_team_cannot_toggle_anonymous_receiving(self): + self.make_participant('team', number='plural') + response = self.client.PxST( + '/team/anonymous.json', + auth_as='team', + data={'toggle': 'receiving'} + ) + actual = response.code + expected = 400 + assert actual == expected + def test_participant_can_toggle_anonymous_giving_back(self): response = self.hit_anonymous('POST', data={'toggle': 'giving'}) response = self.hit_anonymous('POST', data={'toggle': 'giving'})