Repository: liqd/a4-meinberlin

Issue:
testing 4293: can't edit polls somebody else created even if I have the rights
**URL:** https://meinberlin-dev.liqd.net/dashboard/modules/umfrage-24-4/poll/
**user:** group member
**expected behaviour:** I can edit polls somebody else created if I have the right to do so
**behaviour:** cannot save, getting an red altert
**important screensize:**
**device & browser:** 
 **Comment/Question:** also true for new polls whose rights have been given to me. for polls I started myself it is fine.

![Bildschirmfoto 2021-07-05 um 10 32 14](https://user-images.githubusercontent.com/35491681/124444710-2bc75180-dd7f-11eb-946b-78cc99c9c975.png)

Screenshot?



Discussion:
I think this is also true for initiators and moderators that cannot edit polls that have been created by others, only admin can change all polls, no matter who created them
> I think this is also true for initiators and moderators that cannot edit polls that have been created by others, only admin can change all polls, no matter who created them

This does work for moderators and initiators (at least when I tested it, could you check again?)
That is also why a group member that added the poll can edit it: she becomes a moderator automatically. But for group members, you are right! Good catch! But it should never have worked and probably was there from when we added the groups. I will also check the documents!
@fuzzylogic2000 I will check again. But what should never have worked? So far we didn't have problems with groups, so you can easily give a group the right for a project they haven't created via django. Has been working fine so far.
I think a group member was never able to change the poll. (Only if they also were moderators, which was likely to happen, they could.)
was that only for polls? nobody ever noticed :-)
but you are right, I checked again as moderator and in one project I can change one poll but not the other, so there is another problem I cannot find. Can you check https://meinberlin-dev.liqd.net/dashboard/modules/umfrage-43/poll/, e.g. as moderator I cannot save the (second) poll.
I can! But you coudln't because of the other problem we currently have: you cannot update any polls that have open choices. :grimacing: @Rineee is currently fixing that.

Resolving patch:
diff --git a/meinberlin/apps/polls/rules.py b/meinberlin/apps/polls/rules.py
--- a/meinberlin/apps/polls/rules.py
+++ b/meinberlin/apps/polls/rules.py
@@ -4,6 +4,5 @@
 
 rules.set_perm(
     'a4polls.change_poll',
-    module_predicates.is_context_initiator |
-    module_predicates.is_context_moderator
+    module_predicates.is_project_admin
 )


Test patch:
diff --git a/tests/polls/rules/test_rules_change_poll.py b/tests/polls/rules/test_rules_change_poll.py
--- a/tests/polls/rules/test_rules_change_poll.py
+++ b/tests/polls/rules/test_rules_change_poll.py
@@ -8,6 +8,7 @@
 from adhocracy4.test.helpers import freeze_pre_phase
 from adhocracy4.test.helpers import setup_phase
 from adhocracy4.test.helpers import setup_users
+from meinberlin.test.helpers import setup_group_member
 
 perm_name = 'a4polls.change_poll'
 
@@ -17,12 +18,16 @@ def test_perm_exists():
 
 
 @pytest.mark.django_db
-def test_pre_phase(phase_factory, poll_factory, user):
+def test_pre_phase(phase_factory, poll_factory, user_factory,
+                   group_factory):
     phase, _, project, item = setup_phase(phase_factory, poll_factory,
                                           phases.VotingPhase)
     anonymous, moderator, initiator = setup_users(project)
-
     creator = item.creator
+    user = user_factory()
+    group_member, _, project = setup_group_member(None, project,
+                                                  group_factory,
+                                                  user_factory)
 
     assert project.is_public
     with freeze_pre_phase(phase):
@@ -31,14 +36,20 @@ def test_pre_phase(phase_factory, poll_factory, user):
         assert not rules.has_perm(perm_name, creator, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, group_member, item)
 
 
 @pytest.mark.django_db
-def test_phase_active(phase_factory, poll_factory, user):
+def test_phase_active(phase_factory, poll_factory, user_factory,
+                      group_factory):
     phase, _, project, item = setup_phase(phase_factory, poll_factory,
                                           phases.VotingPhase)
     anonymous, moderator, initiator = setup_users(project)
     creator = item.creator
+    user = user_factory()
+    group_member, _, project = setup_group_member(None, project,
+                                                  group_factory,
+                                                  user_factory)
 
     assert project.is_public
     with freeze_phase(phase):
@@ -47,18 +58,23 @@ def test_phase_active(phase_factory, poll_factory, user):
         assert not rules.has_perm(perm_name, creator, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, group_member, item)
 
 
 @pytest.mark.django_db
 def test_phase_active_project_private(phase_factory, poll_factory,
-                                      user, user2):
+                                      user_factory, group_factory):
     phase, _, project, item = setup_phase(
         phase_factory, poll_factory, phases.VotingPhase,
         module__project__access=Access.PRIVATE)
     anonymous, moderator, initiator = setup_users(project)
     creator = item.creator
-    participant = user2
+    participant = user_factory()
     project.participants.add(participant)
+    user = user_factory()
+    group_member, _, project = setup_group_member(None, project,
+                                                  group_factory,
+                                                  user_factory)
 
     assert project.access == Access.PRIVATE
     with freeze_phase(phase):
@@ -68,18 +84,23 @@ def test_phase_active_project_private(phase_factory, poll_factory,
         assert not rules.has_perm(perm_name, participant, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, group_member, item)
 
 
 @pytest.mark.django_db
 def test_phase_active_project_semipublic(phase_factory, poll_factory,
-                                         user, user2):
+                                         user_factory, group_factory):
     phase, _, project, item = setup_phase(
         phase_factory, poll_factory, phases.VotingPhase,
         module__project__access=Access.SEMIPUBLIC)
     anonymous, moderator, initiator = setup_users(project)
     creator = item.creator
-    participant = user2
+    participant = user_factory()
     project.participants.add(participant)
+    user = user_factory()
+    group_member, _, project = setup_group_member(None, project,
+                                                  group_factory,
+                                                  user_factory)
 
     assert project.access == Access.SEMIPUBLIC
     with freeze_phase(phase):
@@ -89,15 +110,21 @@ def test_phase_active_project_semipublic(phase_factory, poll_factory,
         assert not rules.has_perm(perm_name, participant, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, group_member, item)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_draft(phase_factory, poll_factory, user):
+def test_phase_active_project_draft(phase_factory, poll_factory,
+                                    user_factory, group_factory):
     phase, _, project, item = setup_phase(phase_factory, poll_factory,
                                           phases.VotingPhase,
                                           module__project__is_draft=True)
     anonymous, moderator, initiator = setup_users(project)
     creator = item.creator
+    user = user_factory()
+    group_member, _, project = setup_group_member(None, project,
+                                                  group_factory,
+                                                  user_factory)
 
     assert project.is_draft
     with freeze_phase(phase):
@@ -106,15 +133,21 @@ def test_phase_active_project_draft(phase_factory, poll_factory, user):
         assert not rules.has_perm(perm_name, creator, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, group_member, item)
 
 
 @pytest.mark.django_db
-def test_post_phase_project_archived(phase_factory, poll_factory, user):
+def test_post_phase_project_archived(phase_factory, poll_factory,
+                                     user_factory, group_factory):
     phase, _, project, item = setup_phase(phase_factory, poll_factory,
                                           phases.VotingPhase,
                                           module__project__is_archived=True)
     anonymous, moderator, initiator = setup_users(project)
     creator = item.creator
+    user = user_factory()
+    group_member, _, project = setup_group_member(None, project,
+                                                  group_factory,
+                                                  user_factory)
 
     assert project.is_archived
     with freeze_post_phase(phase):
@@ -123,3 +156,4 @@ def test_post_phase_project_archived(phase_factory, poll_factory, user):
         assert not rules.has_perm(perm_name, creator, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, group_member, item)