Repository: ckan/ckan

Issue:
Server error at /organization if not authorized to list organizations
### CKAN Version if known (or site URL)

2.5.2
### Please describe the expected behaviour

The behaviour should be similar to if the user goes to /organization/foo and does not have "organization_show" access ie the user gets logged out and sees a message "Organizations are not available."
### Please describe the actual behaviour

Server error:

```
URL: http://localhost:5000/organization
File '/home/martinb/workspace/ckan/lib/default/local/lib/python2.7/site-packages/weberror/evalexception.py', line 428 in respond
  app_iter = self.application(environ, detect_start_response)
File '/home/martinb/workspace/ckan/lib/default/local/lib/python2.7/site-packages/webob/dec.py', line 147 in __call__
  resp = self.call_func(req, *args, **self.kwargs)
File '/home/martinb/workspace/ckan/lib/default/local/lib/python2.7/site-packages/webob/dec.py', line 208 in call_func
  return self.func(req, *args, **kwargs)
File '/home/martinb/workspace/ckan/lib/default/local/lib/python2.7/site-packages/fanstatic/publisher.py', line 234 in __call__
  return request.get_response(self.app)
File '/home/martinb/workspace/ckan/lib/default/local/lib/python2.7/site-packages/webob/request.py', line 1053 in get_response
  application, catch_exc_info=False)
File '/home/martinb/workspace/ckan/lib/default/local/lib/python2.7/site-packages/webob/request.py', line 1022 in call_application
  app_iter = application(self.environ, start_response)
File '/home/martinb/workspace/ckan/lib/default/local/lib/python2.7/site-packages/webob/dec.py', line 147 in __call__
  resp = self.call_func(req, *args, **self.kwargs)
File '/home/martinb/workspace/ckan/lib/default/local/lib/python2.7/site-packages/webob/dec.py', line 208 in call_func
  return self.func(req, *args, **kwargs)
File '/home/martinb/workspace/ckan/lib/default/local/lib/python2.7/site-packages/fanstatic/injector.py', line 54 in __call__
  response = request.get_response(self.app)
File '/home/martinb/workspace/ckan/lib/default/local/lib/python2.7/site-packages/webob/request.py', line 1053 in get_response
  application, catch_exc_info=False)
File '/home/martinb/workspace/ckan/lib/default/local/lib/python2.7/site-packages/webob/request.py', line 1022 in call_application
  app_iter = application(self.environ, start_response)
File '/home/martinb/workspace/ckan/lib/default/src/ckan/ckan/config/middleware.py', line 389 in inner
  result = application(environ, start_response)
File '/home/martinb/workspace/ckan/lib/default/local/lib/python2.7/site-packages/beaker/middleware.py', line 73 in __call__
  return self.app(environ, start_response)
File '/home/martinb/workspace/ckan/lib/default/local/lib/python2.7/site-packages/beaker/middleware.py', line 155 in __call__
  return self.wrap_app(environ, session_start_response)
File '/home/martinb/workspace/ckan/lib/default/local/lib/python2.7/site-packages/routes/middleware.py', line 131 in __call__
  response = self.app(environ, start_response)
File '/home/martinb/workspace/ckan/lib/default/local/lib/python2.7/site-packages/pylons/wsgiapp.py', line 125 in __call__
  response = self.dispatch(controller, environ, start_response)
File '/home/martinb/workspace/ckan/lib/default/local/lib/python2.7/site-packages/pylons/wsgiapp.py', line 324 in dispatch
  return controller(environ, start_response)
File '/home/martinb/workspace/ckan/lib/default/src/ckan/ckan/lib/base.py', line 337 in __call__
  res = WSGIController.__call__(self, environ, start_response)
File '/home/martinb/workspace/ckan/lib/default/local/lib/python2.7/site-packages/pylons/controllers/core.py', line 221 in __call__
  response = self._dispatch_call()
File '/home/martinb/workspace/ckan/lib/default/local/lib/python2.7/site-packages/pylons/controllers/core.py', line 172 in _dispatch_call
  response = self._inspect_call(func)
File '/home/martinb/workspace/ckan/lib/default/local/lib/python2.7/site-packages/pylons/controllers/core.py', line 107 in _inspect_call
  result = self._perform_call(func, args)
File '/home/martinb/workspace/ckan/lib/default/local/lib/python2.7/site-packages/pylons/controllers/core.py', line 60 in _perform_call
  return func(**args)
File '/home/martinb/workspace/ckan/lib/default/src/ckan/ckan/controllers/group.py', line 178 in index
  data_dict_global_results)
File '/home/martinb/workspace/ckan/lib/default/src/ckan/ckan/logic/__init__.py', line 416 in wrapped
  result = _action(context, data_dict, **kw)
File '/home/martinb/workspace/ckan/lib/default/src/ckan/ckan/logic/action/get.py', line 608 in organization_list
  _check_access('organization_list', context, data_dict)
File '/home/martinb/workspace/ckan/lib/default/src/ckan/ckan/logic/__init__.py', line 286 in check_access
  raise NotAuthorized(msg)
NotAuthorized: <function unauthorized at 0x7f1d7e787410> requires an authenticated user
```
### What steps can be taken to reproduce the issue?

Log in with a user that does not have "organization_list" access and go to /organization



Discussion:
@k-nut if you've got some time, this looks like a quick one


Resolving patch:
diff --git a/ckan/controllers/group.py b/ckan/controllers/group.py
--- a/ckan/controllers/group.py
+++ b/ckan/controllers/group.py
@@ -159,6 +159,7 @@ def index(self):
         sort_by = c.sort_by_selected = request.params.get('sort')
         try:
             self._check_access('site_read', context)
+            self._check_access('group_list', context)
         except NotAuthorized:
             abort(403, _('Not authorized to see this page'))
 


Test patch:
diff --git a/ckan/tests/controllers/test_organization.py b/ckan/tests/controllers/test_organization.py
--- a/ckan/tests/controllers/test_organization.py
+++ b/ckan/tests/controllers/test_organization.py
@@ -1,6 +1,7 @@
 from bs4 import BeautifulSoup
 from nose.tools import assert_equal, assert_true
 from routes import url_for
+from mock import patch
 
 from ckan.tests import factories, helpers
 from ckan.tests.helpers import webtest_submit, submit_and_follow, assert_in
@@ -61,6 +62,22 @@ def test_all_fields_saved(self):
         assert_equal(group['description'], 'Sciencey datasets')
 
 
+class TestOrganizationList(helpers.FunctionalTestBase):
+    def setup(self):
+        super(TestOrganizationList, self).setup()
+        self.app = helpers._get_test_app()
+        self.user = factories.User()
+        self.user_env = {'REMOTE_USER': self.user['name'].encode('ascii')}
+        self.organization_list_url = url_for(controller='organization',
+                                             action='index')
+
+    @patch('ckan.logic.auth.get.organization_list', return_value={'success': False})
+    def test_error_message_shown_when_no_organization_list_permission(self, mock_check_access):
+        response = self.app.get(url=self.organization_list_url,
+                                extra_environ=self.user_env,
+                                status=403)
+
+
 class TestOrganizationRead(helpers.FunctionalTestBase):
     def setup(self):
         super(TestOrganizationRead, self).setup()