Repository: carpentries/amy

Issue:
Can't edit person
I lost the access(?) to edit a person. I.e. for some of the Instructor Training Trainees I wanted to add a note that they will be late with checkout because of whatever reason they emailed me about but when I click "Edit" on the person I get 403 Forbidden. I used to be able to edit (I think I'm an admin).
Can't edit person
I lost the access(?) to edit a person. I.e. for some of the Instructor Training Trainees I wanted to add a note that they will be late with checkout because of whatever reason they emailed me about but when I click "Edit" on the person I get 403 Forbidden. I used to be able to edit (I think I'm an admin).


Discussion:
@apawlik please check now. As a workaround, I've given you superuser status.

This bug affects all people who don't have superuser status. This is because of [this line](https://github.com/swcarpentry/amy/blob/f5f1301e197ee5a203172fe4beaf9ee9a31269b0/workshops/views.py#L730). The permission name should be `workshops.change_person`, not `workshops.edit_person`.


@apawlik please check now. As a workaround, I've given you superuser status.

This bug affects all people who don't have superuser status. This is because of [this line](https://github.com/swcarpentry/amy/blob/f5f1301e197ee5a203172fe4beaf9ee9a31269b0/workshops/views.py#L730). The permission name should be `workshops.change_person`, not `workshops.edit_person`.



Resolving patch:
diff --git a/workshops/views.py b/workshops/views.py
--- a/workshops/views.py
+++ b/workshops/views.py
@@ -727,7 +727,7 @@ class PersonUpdate(OnlyForAdminsMixin, UserPassesTestMixin,
     template_name = 'workshops/person_edit_form.html'
 
     def test_func(self):
-        if not (self.request.user.has_perm('workshops.edit_person') or \
+        if not (self.request.user.has_perm('workshops.change_person') or \
             self.request.user == self.get_object()):
             raise PermissionDenied
         return True


Test patch:
diff --git a/workshops/test/test_person.py b/workshops/test/test_person.py
--- a/workshops/test/test_person.py
+++ b/workshops/test/test_person.py
@@ -174,6 +174,26 @@ def test_edit_person_notes(self):
             self._check_status_code_and_parse(response, 200)
             assert False, 'expected 302 redirect after post'
 
+    def test_1185_regression(self):
+        """Ensure that admins without superuser privileges,
+        but with 'change_person' permission can edit other people.
+
+        Regression test against
+        https://github.com/swcarpentry/amy/issues/1185."""
+
+        manager = Person.objects.create_user(
+            username='manager', personal='Manager', family='Manager',
+            email='manager@example.org', password='manager')
+        can_change_person = Permission.objects.get(codename='change_person')
+        manager.user_permissions.add(can_change_person)
+        bob = Person.objects.create_user(
+            username='bob', personal='Bob', family='Smith',
+            email='bob@example.org', password='bob')
+
+        bob_edit_url = reverse('person_edit', args=[bob.id])
+        res = self.app.get(bob_edit_url, user='manager')
+        self.assertEqual(res.status_code, 200)
+
     def test_person_award_badge(self):
         """Ensure that we can add an award from `person_edit` view"""
         url = reverse('person_edit', args=[self.spiderman.pk])