fix pep8

I prevented them from seeing the change stream, didn't prevent them seeing individual histories. This has to be done as otherwise it leaks financial information. If I can be arsed I'll come back to this and allow basic users to see a filtered version.

RIGS/templates/RIGS/password_reset_disable.html

@@ -0,0 +1,9 @@
+{% extends 'base_rigs.html' %}
+
+{% block title %}Password Reset Disabled{% endblock %}
+
+{% block content %}
+<h1>Password reset is disabled</h1>
+<p> We are very sorry for the inconvenience, but due to a security vulnerability, password reset is currently disabled until the vulnerability can be patched.</p>
+<p> If you are locked out of your account, please contact an administrator and we can manually perform a reset</p>
+{% endblock %}

RIGS/urls.py

@@ -19,7 +19,7 @@ urlpatterns = [
     url('^user/login/$', views.login, name='login'),
     url('^user/login/embed/$', xframe_options_exempt(views.login_embed), name='login_embed'),
 
-    url(r'^user/password_reset/$', password_reset, {'password_reset_form': forms.PasswordReset}),
+    url(r'^user/password_reset/$', views.PasswordResetDisabled.as_view()),
 
     # People
     url(r'^people/$', permission_required_with_403('RIGS.view_person')(views.PersonList.as_view()),

RIGS/views.py

@@ -392,3 +392,7 @@ class ResetApiKey(generic.RedirectView):
         self.request.user.save()
 
         return reverse_lazy('profile_detail')
+
+
+class PasswordResetDisabled(generic.TemplateView):
+    template_name = "RIGS/password_reset_disable.html"

assets/migrations/0009_auto_20200102_1933.py

@@ -1,21 +0,0 @@
-# Generated by Django 2.0.13 on 2020-01-02 19:33
-
-from django.db import migrations
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ('assets', '0008_auto_20191206_2124'),
-    ]
-
-    operations = [
-        migrations.AlterModelOptions(
-            name='assetcategory',
-            options={'ordering': ['name'], 'verbose_name': 'Asset Category', 'verbose_name_plural': 'Asset Categories'},
-        ),
-        migrations.AlterModelOptions(
-            name='assetstatus',
-            options={'ordering': ['name'], 'verbose_name': 'Asset Status', 'verbose_name_plural': 'Asset Statuses'},
-        ),
-    ]

assets/migrations/0009_auto_20200103_2215.py

@@ -1,12 +1,11 @@
-# Generated by Django 2.0.13 on 2020-01-02 20:42
+# Generated by Django 2.0.13 on 2020-01-03 22:15
 
 from django.db import migrations, models
+import django.db.models.deletion
 
 
 class Migration(migrations.Migration):
 
-    replaces = [('assets', '0009_auto_20200102_1933'), ('assets', '0010_assetstatus_display_class'), ('assets', '0011_auto_20200102_2040')]
-
     dependencies = [
         ('assets', '0008_auto_20191206_2124'),
     ]
@@ -23,6 +22,11 @@ class Migration(migrations.Migration):
         migrations.AddField(
             model_name='assetstatus',
             name='display_class',
-            field=models.CharField(help_text='HTML class to be appended to alter display of assets with this status, such as in the list.', max_length=80),
+            field=models.CharField(blank=True, help_text='HTML class to be appended to alter display of assets with this status, such as in the list.', max_length=80, null=True),
+        ),
+        migrations.AlterField(
+            model_name='asset',
+            name='purchased_from',
+            field=models.ForeignKey(blank=True, null=True, on_delete=django.db.models.deletion.CASCADE, related_name='assets', to='assets.Supplier'),
         ),
     ]

assets/migrations/0010_assetstatus_display_class.py

@@ -1,18 +0,0 @@
-# Generated by Django 2.0.13 on 2020-01-02 19:35
-
-from django.db import migrations, models
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ('assets', '0009_auto_20200102_1933'),
-    ]
-
-    operations = [
-        migrations.AddField(
-            model_name='assetstatus',
-            name='display_class',
-            field=models.TextField(default='', help_text='HTML class to be appended to alter display of assets with this status, such as in the list.'),
-        ),
-    ]

assets/migrations/0010_auto_20200103_2134.py

@@ -1,19 +0,0 @@
-# Generated by Django 2.0.13 on 2020-01-03 21:34
-
-from django.db import migrations, models
-import django.db.models.deletion
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ('assets', '0009_auto_20200102_1933_squashed_0011_auto_20200102_2040'),
-    ]
-
-    operations = [
-        migrations.AlterField(
-            model_name='asset',
-            name='purchased_from',
-            field=models.ForeignKey(blank=True, null=True, on_delete=django.db.models.deletion.CASCADE, related_name='assets', to='assets.Supplier'),
-        ),
-    ]

assets/migrations/0011_auto_20200102_2040.py

@@ -1,18 +0,0 @@
-# Generated by Django 2.0.13 on 2020-01-02 20:40
-
-from django.db import migrations, models
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ('assets', '0010_assetstatus_display_class'),
-    ]
-
-    operations = [
-        migrations.AlterField(
-            model_name='assetstatus',
-            name='display_class',
-            field=models.CharField(help_text='HTML class to be appended to alter display of assets with this status, such as in the list.', max_length=80),
-        ),
-    ]

assets/models.py

@@ -33,7 +33,7 @@ class AssetStatus(models.Model):
     name = models.CharField(max_length=80)
     should_show = models.BooleanField(
         default=True, help_text="Should this be shown by default in the asset list.")
-    display_class = models.CharField(max_length=80, help_text="HTML class to be appended to alter display of assets with this status, such as in the list.")
+    display_class = models.CharField(max_length=80, blank=True, null=True, help_text="HTML class to be appended to alter display of assets with this status, such as in the list.")
 
     def __str__(self):
         return self.name

assets/templates/asset_update.html

@@ -44,7 +44,7 @@
   </div>
 </form>
 
-{% if not edit %}
+{% if not edit and perms.assets.view_asset %}
 <div class="col-sm-12 text-right">
     <div>
         <a href="{% url 'asset_history' object.asset_id %}" title="View Revision History">

assets/urls.py

@@ -15,7 +15,7 @@ urlpatterns = [
          (views.AssetEdit.as_view()), name='asset_update'),
     path('asset/id/<str:pk>/duplicate/', permission_required_with_403('assets.add_asset')
          (views.AssetDuplicate.as_view()), name='asset_duplicate'),
-    path('asset/id/<str:pk>/history/', views.AssetVersionHistory.as_view(),
+    path('asset/id/<str:pk>/history/', permission_required_with_403('assets.view_asset')(views.AssetVersionHistory.as_view()),
          name='asset_history', kwargs={'model': models.Asset}),
     path('activity', permission_required_with_403('assets.view_asset')
          (views.ActivityTable.as_view()), name='asset_activity_table'),

assets/views.py

@@ -213,8 +213,9 @@ class SupplierVersionHistory(versioning.VersionHistory):
     template_name = "asset_version_history.html"
 
 
-# TODO: Reduce SQL queries
 class AssetVersionHistory(versioning.VersionHistory):
+    template_name = "asset_version_history.html"
+
     def get_object(self, **kwargs):
         return get_object_or_404(models.Asset, asset_id=self.kwargs['pk'])
 

templates/base_assets.html

@@ -10,7 +10,7 @@
 {% endblock %}
 
 {% block titleelements %}
-    {% if perms.assets.view_asset %}
+    {# % if perms.assets.view_asset % #}
         <li class="dropdown">
             <a href="#" class="dropdown-toggle" data-toggle="dropdown">Assets<b class="caret"></b></a>
             <ul class="dropdown-menu">
@@ -20,19 +20,19 @@
                 {% endif %}
             </ul>
         </li>
-    {% endif %}
+    {# % endif % #}
-    {% if perms.assets.view_supplier %}
+    {# % if perms.assets.view_supplier % #}
         <li class="dropdown">
             <a href="#" class="dropdown-toggle" data-toggle="dropdown"> Suppliers<b class="caret"></b></a>
             <ul class="dropdown-menu">
                 <li><a href="{% url 'supplier_list' %}"><span class="glyphicon glyphicon-list"></span>
                     List Suppliers</a></li>
-                {% if perms.assets.add_asset %}
+                {% if perms.assets.add_supplier %}
                     <li><a href="{% url 'supplier_create' %}"><span class="glyphicon glyphicon-plus"></span> Create Supplier</a></li>
                 {% endif %}
             </ul>
         </li>
-    {% endif %}
+    {# % endif % #}
     {% if perms.assets.view_asset %}
         <li><a href="{% url 'asset_activity_table' %}">Recent Changes</a></li>
     {% endif %}