Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: Explicitly call out readonly user fields #21889

Merged
merged 4 commits into from
Apr 26, 2024
Merged

fix: Explicitly call out readonly user fields #21889

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
9a62f7b
Fixed up read only fields
benjackwhite Apr 26, 2024
a761969
Remove test
benjackwhite Apr 26, 2024
b997b89
Update query snapshots
github-actions[bot] Apr 26, 2024
df18cbe
Update query snapshots
github-actions[bot] Apr 26, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
248 changes: 90 additions & 158 deletions posthog/api/test/__snapshots__/test_annotation.ambr
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -85,6 +85,85 @@
'''
# ---
# name: TestAnnotation.test_retrieving_annotation_is_not_n_plus_1.10
'''
SELECT "posthog_annotation"."id",
"posthog_annotation"."content",
"posthog_annotation"."created_at",
"posthog_annotation"."updated_at",
"posthog_annotation"."dashboard_item_id",
"posthog_annotation"."team_id",
"posthog_annotation"."organization_id",
"posthog_annotation"."created_by_id",
"posthog_annotation"."scope",
"posthog_annotation"."creation_type",
"posthog_annotation"."date_marker",
"posthog_annotation"."deleted",
"posthog_annotation"."apply_all",
"posthog_dashboarditem"."id",
"posthog_dashboarditem"."name",
"posthog_dashboarditem"."derived_name",
"posthog_dashboarditem"."description",
"posthog_dashboarditem"."team_id",
"posthog_dashboarditem"."filters",
"posthog_dashboarditem"."filters_hash",
"posthog_dashboarditem"."query",
"posthog_dashboarditem"."order",
"posthog_dashboarditem"."deleted",
"posthog_dashboarditem"."saved",
"posthog_dashboarditem"."created_at",
"posthog_dashboarditem"."last_refresh",
"posthog_dashboarditem"."refreshing",
"posthog_dashboarditem"."created_by_id",
"posthog_dashboarditem"."is_sample",
"posthog_dashboarditem"."short_id",
"posthog_dashboarditem"."favorited",
"posthog_dashboarditem"."refresh_attempt",
"posthog_dashboarditem"."last_modified_at",
"posthog_dashboarditem"."last_modified_by_id",
"posthog_dashboarditem"."dashboard_id",
"posthog_dashboarditem"."layouts",
"posthog_dashboarditem"."color",
"posthog_dashboarditem"."dive_dashboard_id",
"posthog_dashboarditem"."updated_at",
"posthog_dashboarditem"."deprecated_tags",
"posthog_dashboarditem"."tags",
"posthog_user"."id",
"posthog_user"."password",
"posthog_user"."last_login",
"posthog_user"."first_name",
"posthog_user"."last_name",
"posthog_user"."is_staff",
"posthog_user"."is_active",
"posthog_user"."date_joined",
"posthog_user"."uuid",
"posthog_user"."current_organization_id",
"posthog_user"."current_team_id",
"posthog_user"."email",
"posthog_user"."pending_email",
"posthog_user"."temporary_token",
"posthog_user"."distinct_id",
"posthog_user"."is_email_verified",
"posthog_user"."requested_password_reset_at",
"posthog_user"."has_seen_product_intro_for",
"posthog_user"."strapi_id",
"posthog_user"."email_opt_in",
"posthog_user"."theme_mode",
"posthog_user"."partial_notification_settings",
"posthog_user"."anonymize_data",
"posthog_user"."toolbar_mode",
"posthog_user"."events_column_config"
FROM "posthog_annotation"
LEFT OUTER JOIN "posthog_dashboarditem" ON ("posthog_annotation"."dashboard_item_id" = "posthog_dashboarditem"."id")
LEFT OUTER JOIN "posthog_user" ON ("posthog_annotation"."created_by_id" = "posthog_user"."id")
WHERE ((("posthog_annotation"."organization_id" = '00000000-0000-0000-0000-000000000000'::uuid
AND "posthog_annotation"."scope" = 'organization')
OR "posthog_annotation"."team_id" = 2)
AND NOT "posthog_annotation"."deleted")
ORDER BY "posthog_annotation"."date_marker" DESC
LIMIT 1000
'''
# ---
# name: TestAnnotation.test_retrieving_annotation_is_not_n_plus_1.11
'''
SELECT "posthog_user"."id",
"posthog_user"."password",
Expand Down Expand Up @@ -115,7 +194,7 @@
LIMIT 21
'''
# ---
# name: TestAnnotation.test_retrieving_annotation_is_not_n_plus_1.11
# name: TestAnnotation.test_retrieving_annotation_is_not_n_plus_1.12
'''
SELECT "posthog_team"."id",
"posthog_team"."uuid",
Expand Down Expand Up @@ -169,7 +248,7 @@
LIMIT 21
'''
# ---
# name: TestAnnotation.test_retrieving_annotation_is_not_n_plus_1.12
# name: TestAnnotation.test_retrieving_annotation_is_not_n_plus_1.13
'''
SELECT "posthog_organizationmembership"."id",
"posthog_organizationmembership"."organization_id",
Expand Down Expand Up @@ -201,93 +280,14 @@
WHERE "posthog_organizationmembership"."user_id" = 2
'''
# ---
# name: TestAnnotation.test_retrieving_annotation_is_not_n_plus_1.13
'''
SELECT COUNT(*) AS "__count"
FROM "posthog_annotation"
WHERE ((("posthog_annotation"."organization_id" = '00000000-0000-0000-0000-000000000000'::uuid
AND "posthog_annotation"."scope" = 'organization')
OR "posthog_annotation"."team_id" = 2)
AND NOT "posthog_annotation"."deleted")
'''
# ---
# name: TestAnnotation.test_retrieving_annotation_is_not_n_plus_1.14
'''
SELECT "posthog_annotation"."id",
"posthog_annotation"."content",
"posthog_annotation"."created_at",
"posthog_annotation"."updated_at",
"posthog_annotation"."dashboard_item_id",
"posthog_annotation"."team_id",
"posthog_annotation"."organization_id",
"posthog_annotation"."created_by_id",
"posthog_annotation"."scope",
"posthog_annotation"."creation_type",
"posthog_annotation"."date_marker",
"posthog_annotation"."deleted",
"posthog_annotation"."apply_all",
"posthog_dashboarditem"."id",
"posthog_dashboarditem"."name",
"posthog_dashboarditem"."derived_name",
"posthog_dashboarditem"."description",
"posthog_dashboarditem"."team_id",
"posthog_dashboarditem"."filters",
"posthog_dashboarditem"."filters_hash",
"posthog_dashboarditem"."query",
"posthog_dashboarditem"."order",
"posthog_dashboarditem"."deleted",
"posthog_dashboarditem"."saved",
"posthog_dashboarditem"."created_at",
"posthog_dashboarditem"."last_refresh",
"posthog_dashboarditem"."refreshing",
"posthog_dashboarditem"."created_by_id",
"posthog_dashboarditem"."is_sample",
"posthog_dashboarditem"."short_id",
"posthog_dashboarditem"."favorited",
"posthog_dashboarditem"."refresh_attempt",
"posthog_dashboarditem"."last_modified_at",
"posthog_dashboarditem"."last_modified_by_id",
"posthog_dashboarditem"."dashboard_id",
"posthog_dashboarditem"."layouts",
"posthog_dashboarditem"."color",
"posthog_dashboarditem"."dive_dashboard_id",
"posthog_dashboarditem"."updated_at",
"posthog_dashboarditem"."deprecated_tags",
"posthog_dashboarditem"."tags",
"posthog_user"."id",
"posthog_user"."password",
"posthog_user"."last_login",
"posthog_user"."first_name",
"posthog_user"."last_name",
"posthog_user"."is_staff",
"posthog_user"."is_active",
"posthog_user"."date_joined",
"posthog_user"."uuid",
"posthog_user"."current_organization_id",
"posthog_user"."current_team_id",
"posthog_user"."email",
"posthog_user"."pending_email",
"posthog_user"."temporary_token",
"posthog_user"."distinct_id",
"posthog_user"."is_email_verified",
"posthog_user"."requested_password_reset_at",
"posthog_user"."has_seen_product_intro_for",
"posthog_user"."strapi_id",
"posthog_user"."email_opt_in",
"posthog_user"."theme_mode",
"posthog_user"."partial_notification_settings",
"posthog_user"."anonymize_data",
"posthog_user"."toolbar_mode",
"posthog_user"."events_column_config"
SELECT COUNT(*) AS "__count"
FROM "posthog_annotation"
LEFT OUTER JOIN "posthog_dashboarditem" ON ("posthog_annotation"."dashboard_item_id" = "posthog_dashboarditem"."id")
LEFT OUTER JOIN "posthog_user" ON ("posthog_annotation"."created_by_id" = "posthog_user"."id")
WHERE ((("posthog_annotation"."organization_id" = '00000000-0000-0000-0000-000000000000'::uuid
AND "posthog_annotation"."scope" = 'organization')
OR "posthog_annotation"."team_id" = 2)
AND NOT "posthog_annotation"."deleted")
ORDER BY "posthog_annotation"."date_marker" DESC
LIMIT 1000
'''
# ---
# name: TestAnnotation.test_retrieving_annotation_is_not_n_plus_1.15
Expand Down Expand Up @@ -541,90 +541,22 @@
# ---
# name: TestAnnotation.test_retrieving_annotation_is_not_n_plus_1.8
'''
SELECT COUNT(*) AS "__count"
FROM "posthog_annotation"
WHERE ((("posthog_annotation"."organization_id" = '00000000-0000-0000-0000-000000000000'::uuid
AND "posthog_annotation"."scope" = 'organization')
OR "posthog_annotation"."team_id" = 2)
AND NOT "posthog_annotation"."deleted")
SELECT "posthog_instancesetting"."id",
"posthog_instancesetting"."key",
"posthog_instancesetting"."raw_value"
FROM "posthog_instancesetting"
WHERE "posthog_instancesetting"."key" = 'constance:posthog:RATE_LIMIT_ENABLED'
ORDER BY "posthog_instancesetting"."id" ASC
LIMIT 1
'''
# ---
# name: TestAnnotation.test_retrieving_annotation_is_not_n_plus_1.9
'''
SELECT "posthog_annotation"."id",
"posthog_annotation"."content",
"posthog_annotation"."created_at",
"posthog_annotation"."updated_at",
"posthog_annotation"."dashboard_item_id",
"posthog_annotation"."team_id",
"posthog_annotation"."organization_id",
"posthog_annotation"."created_by_id",
"posthog_annotation"."scope",
"posthog_annotation"."creation_type",
"posthog_annotation"."date_marker",
"posthog_annotation"."deleted",
"posthog_annotation"."apply_all",
"posthog_dashboarditem"."id",
"posthog_dashboarditem"."name",
"posthog_dashboarditem"."derived_name",
"posthog_dashboarditem"."description",
"posthog_dashboarditem"."team_id",
"posthog_dashboarditem"."filters",
"posthog_dashboarditem"."filters_hash",
"posthog_dashboarditem"."query",
"posthog_dashboarditem"."order",
"posthog_dashboarditem"."deleted",
"posthog_dashboarditem"."saved",
"posthog_dashboarditem"."created_at",
"posthog_dashboarditem"."last_refresh",
"posthog_dashboarditem"."refreshing",
"posthog_dashboarditem"."created_by_id",
"posthog_dashboarditem"."is_sample",
"posthog_dashboarditem"."short_id",
"posthog_dashboarditem"."favorited",
"posthog_dashboarditem"."refresh_attempt",
"posthog_dashboarditem"."last_modified_at",
"posthog_dashboarditem"."last_modified_by_id",
"posthog_dashboarditem"."dashboard_id",
"posthog_dashboarditem"."layouts",
"posthog_dashboarditem"."color",
"posthog_dashboarditem"."dive_dashboard_id",
"posthog_dashboarditem"."updated_at",
"posthog_dashboarditem"."deprecated_tags",
"posthog_dashboarditem"."tags",
"posthog_user"."id",
"posthog_user"."password",
"posthog_user"."last_login",
"posthog_user"."first_name",
"posthog_user"."last_name",
"posthog_user"."is_staff",
"posthog_user"."is_active",
"posthog_user"."date_joined",
"posthog_user"."uuid",
"posthog_user"."current_organization_id",
"posthog_user"."current_team_id",
"posthog_user"."email",
"posthog_user"."pending_email",
"posthog_user"."temporary_token",
"posthog_user"."distinct_id",
"posthog_user"."is_email_verified",
"posthog_user"."requested_password_reset_at",
"posthog_user"."has_seen_product_intro_for",
"posthog_user"."strapi_id",
"posthog_user"."email_opt_in",
"posthog_user"."theme_mode",
"posthog_user"."partial_notification_settings",
"posthog_user"."anonymize_data",
"posthog_user"."toolbar_mode",
"posthog_user"."events_column_config"
SELECT COUNT(*) AS "__count"
FROM "posthog_annotation"
LEFT OUTER JOIN "posthog_dashboarditem" ON ("posthog_annotation"."dashboard_item_id" = "posthog_dashboarditem"."id")
LEFT OUTER JOIN "posthog_user" ON ("posthog_annotation"."created_by_id" = "posthog_user"."id")
WHERE ((("posthog_annotation"."organization_id" = '00000000-0000-0000-0000-000000000000'::uuid
AND "posthog_annotation"."scope" = 'organization')
OR "posthog_annotation"."team_id" = 2)
AND NOT "posthog_annotation"."deleted")
ORDER BY "posthog_annotation"."date_marker" DESC
LIMIT 1000
'''
# ---
19 changes: 19 additions & 0 deletions posthog/api/test/test_user.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -887,6 +887,25 @@ def assert_forbidden_url(url):
assert_allowed_url("https://subdomain.otherexample.com")
assert_allowed_url("https://sub.subdomain.otherexample.com")

def test_user_cannot_update_protected_fields(self):
self.user.is_staff = False
self.user.save()
fields = {
"date_joined": "2021-01-01T00:00:00Z",
"uuid": str(uuid.uuid4()),
"distinct_id": "distinct_id",
"pending_email": "[email protected]",
"is_email_verified": True,
}

initial_user = self.client.get("/api/users/@me/").json()

for field, value in fields.items():
response = self.client.patch("/api/users/@me/", {field: value})
assert (
response.json()[field] == initial_user[field]
), f"Updating field '{field}' to '{value}' worked when it shouldn't! Was {initial_user[field]} and is now {response.json()[field]}"


class TestUserSlackWebhook(APIBaseTest):
ENDPOINT: str = "/api/user/test_slack_webhook/"
Expand Down
17 changes: 15 additions & 2 deletions posthog/api/user.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -86,7 +86,6 @@ class Meta:
"pending_email",
"email_opt_in",
"is_email_verified",
"pending_email",
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This was a duplicate

"notification_settings",
"anonymize_data",
"toolbar_mode",
Expand All @@ -107,8 +106,22 @@ class Meta:
"scene_personalisation",
"theme_mode",
]

read_only_fields = [
"date_joined",
"uuid",
"distinct_id",
"pending_email",
"is_email_verified",
"has_password",
"is_impersonated",
"team",
"organization",
"organizations",
"has_social_auth",
]

extra_kwargs = {
"date_joined": {"read_only": True},
"password": {"write_only": True},
}

Expand Down
Loading