diff --git a/Admin/urls.py b/Admin/urls.py index 178f7c8..caa6e58 100644 --- a/Admin/urls.py +++ b/Admin/urls.py @@ -3,11 +3,42 @@ from django.contrib import admin from django.urls import path,include from django.conf import settings from django.conf.urls.static import static +from django.shortcuts import render +from django.core.exceptions import PermissionDenied +from django.http import HttpResponse +from django.test import SimpleTestCase, override_settings + +def response_error_handler(request, exception=None): + context={} + return render(request, '403.html',context,status=403) + + +def permission_denied_view(request): + raise PermissionDenied + + + urlpatterns = [ path('admin/', admin.site.urls), path('accounts/', include('allauth.urls')), path('', include('Clientes.urls')), + path('403/', permission_denied_view), ] +handler403 = response_error_handler + + + if settings.DEBUG: #DEV only urlpatterns += static(settings.STATIC_URL, document_root= settings.STATIC_ROOT) - urlpatterns += static(settings.MEDIA_URL, document_root= settings.MEDIA_ROOT) \ No newline at end of file + urlpatterns += static(settings.MEDIA_URL, document_root= settings.MEDIA_ROOT) + + + +# ROOT_URLCONF must specify the module that contains handler403 = ... +@override_settings(ROOT_URLCONF=__name__) +class CustomErrorHandlerTests(SimpleTestCase): + + def test_handler_renders_template_response(self): + response = self.client.get('/403/') + # Make assertions on the response here. For example: + self.assertContains(response, 'Error handler content', status_code=403) \ No newline at end of file diff --git a/Clientes/custom_decorators.py b/Clientes/custom_decorators.py new file mode 100644 index 0000000..c635a1a --- /dev/null +++ b/Clientes/custom_decorators.py @@ -0,0 +1,22 @@ +from functools import wraps +from django.contrib import messages +from django.shortcuts import redirect +from django.http import HttpResponse + + +def Custom_is_staff_function(user): + if user.is_staff: + return True + return False + + +def is_staff_access(view_to_return="index"): + def decorator(view): + @wraps(view) + def _wrapped_view(request, *args, **kwargs): + if not Custom_is_staff_function(request.user): + messages.error(request, "No es personal del staff autorizado.") + return redirect(view_to_return) + return view(request, *args, **kwargs) + return _wrapped_view + return decorator \ No newline at end of file diff --git a/Clientes/urls.py b/Clientes/urls.py index 554db38..633e666 100644 --- a/Clientes/urls.py +++ b/Clientes/urls.py @@ -16,7 +16,6 @@ from .views import ( urlpatterns = [ path('', index, name='index'), path('add_timbre2/', add_timbre2.as_view(), name='add_timbre2'), - path('timbres_cliente//', timbres_cliente, name='timbres_cliente'), path('cliente/update//',ClientesUpdateView.as_view(),name='update_cliente'), path('cliente/add/', ClientesCreateView.as_view(), name='add_cliente'), diff --git a/Clientes/views.py b/Clientes/views.py index 8c7a904..635058b 100644 --- a/Clientes/views.py +++ b/Clientes/views.py @@ -3,6 +3,8 @@ from django.contrib import messages from django.http import HttpResponse from django.http import JsonResponse from django.contrib.auth.decorators import login_required +from .custom_decorators import is_staff_access + from .models import Clientes,Timbres,saldoModel,ErroresTimbres from rest_framework.views import APIView @@ -134,8 +136,7 @@ def send_timbres_Email(request): return redirect('index') @login_required -def index(request): - +def index(request): clientes_list = Clientes.objects.all() mes = request.GET.get('mes', None) page = request.GET.get('page', 1) @@ -174,8 +175,6 @@ def index(request): return render(request,'Clientes/index.html',context) - - def pageFunc(page,qs,per_page): paginator = Paginator(qs,per_page) try: @@ -188,9 +187,12 @@ def pageFunc(page,qs,per_page): @login_required +@is_staff_access() def timbres_cliente(request, RFC): - lista = Timbres.objects.filter(rfcc=RFC) - + if request.user.is_staff: + lista = Timbres.objects.filter(rfcc=RFC) + else: + lista = Timbres.objects.filter(rfcc=RFC,modo='Normal') search = request.GET.get('search',None) page = request.GET.get('page', 1) datepicker = request.GET.get('datepicker', None) @@ -236,10 +238,13 @@ class ClientesUpdateView(UserPassesTestMixin,LoginRequiredMixin,UpdateView): success_url='/' template_name='Clientes/edit_cliente.html' - def test_func(self): - #self.request.user.groups.all() - return self.request.user.groups.filter(name= 'admin_soft') - + def test_func(self): + + res = self.request.user.groups.filter(name= 'admin_soft') + if not res: + messages.error(self.request, f'Lo sentimos. La página que buscas no está disponible, no cuentas con los permisos.') + return res + class ClientesCreateView(UserPassesTestMixin,LoginRequiredMixin,CreateView): model = Clientes diff --git a/Templates/403.html b/Templates/403.html new file mode 100644 index 0000000..c62f4ed --- /dev/null +++ b/Templates/403.html @@ -0,0 +1,35 @@ + + + + + + + + + + + Hello, world! + + +
+ {% include 'partials/messages.html' %} + Forbidden + + + + + Regresar al Inicio + + + + +
+ + + + + + + + + diff --git a/Templates/Clientes/index.html b/Templates/Clientes/index.html index 5ad8f08..d2cd823 100644 --- a/Templates/Clientes/index.html +++ b/Templates/Clientes/index.html @@ -12,7 +12,6 @@ Timbres disponibles Comercio Digital: {{saldo}} - - @@ -133,8 +131,9 @@ Timbres disponibles Comercio Digital: {{saldo}} {% endif %} - + {% endfor %} +
Cliente RFC @@ -56,7 +55,6 @@ Timbres disponibles Comercio Digital: {{saldo}} Excel Todos los clientes X Mes
diff --git a/Templates/Clientes/timbres_cliente.html b/Templates/Clientes/timbres_cliente.html index 44bf5f6..4ec7e36 100644 --- a/Templates/Clientes/timbres_cliente.html +++ b/Templates/Clientes/timbres_cliente.html @@ -17,7 +17,6 @@

- @@ -34,8 +33,8 @@ Fecha - - + + {% for obj in lista %} @@ -48,6 +47,7 @@
{{obj.uuid}}
+ {% endblock content %}