{"action":"created","issue":{"url":"https://api.github.com/repos/uclouvain/osis-portal/issues/285","repository_url":"https://api.github.com/repos/uclouvain/osis-portal","labels_url":"https://api.github.com/repos/uclouvain/osis-portal/issues/285/labels{/name}","comments_url":"https://api.github.com/repos/uclouvain/osis-portal/issues/285/comments","events_url":"https://api.github.com/repos/uclouvain/osis-portal/issues/285/events","html_url":"https://github.com/uclouvain/osis-portal/pull/285","id":170424856,"number":285,"title":"Feature/212 Add attachments for admission","user":{"login":"edd19","id":7523653,"avatar_url":"https://avatars.githubusercontent.com/u/7523653?v=3","gravatar_id":"","url":"https://api.github.com/users/edd19","html_url":"https://github.com/edd19","followers_url":"https://api.github.com/users/edd19/followers","following_url":"https://api.github.com/users/edd19/following{/other_user}","gists_url":"https://api.github.com/users/edd19/gists{/gist_id}","starred_url":"https://api.github.com/users/edd19/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/edd19/subscriptions","organizations_url":"https://api.github.com/users/edd19/orgs","repos_url":"https://api.github.com/users/edd19/repos","events_url":"https://api.github.com/users/edd19/events{/privacy}","received_events_url":"https://api.github.com/users/edd19/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2016-08-10T14:02:20Z","updated_at":"2016-08-11T07:47:02Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/uclouvain/osis-portal/pulls/285","html_url":"https://github.com/uclouvain/osis-portal/pull/285","diff_url":"https://github.com/uclouvain/osis-portal/pull/285.diff","patch_url":"https://github.com/uclouvain/osis-portal/pull/285.patch"},"body":"Inform the ticket you are solving in this pull request: #212 \r\n\r\nTo have your pull request accepted you have to make sure that:\r\n\r\n- [x] it contains only **well formatted** code, using **4 spaces** for identation and a maximum of **120 characters** per line.\r\n- [x] classes, methods or function names are **not abreviated**.\r\n- [x] the code seems **readable for other developers** who will maintain this code in the future.\r\n- [x] in case complexity is needed, then the code is very **well documented**.\r\n- [x] all files contain the **license header**.\r\n"},"comment":{"url":"https://api.github.com/repos/uclouvain/osis-portal/issues/comments/239094014","html_url":"https://github.com/uclouvain/osis-portal/pull/285#issuecomment-239094014","issue_url":"https://api.github.com/repos/uclouvain/osis-portal/issues/285","id":239094014,"user":{"login":"glamarca","id":11191415,"avatar_url":"https://avatars.githubusercontent.com/u/11191415?v=3","gravatar_id":"","url":"https://api.github.com/users/glamarca","html_url":"https://github.com/glamarca","followers_url":"https://api.github.com/users/glamarca/followers","following_url":"https://api.github.com/users/glamarca/following{/other_user}","gists_url":"https://api.github.com/users/glamarca/gists{/gist_id}","starred_url":"https://api.github.com/users/glamarca/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/glamarca/subscriptions","organizations_url":"https://api.github.com/users/glamarca/orgs","repos_url":"https://api.github.com/users/glamarca/repos","events_url":"https://api.github.com/users/glamarca/events{/privacy}","received_events_url":"https://api.github.com/users/glamarca/received_events","type":"User","site_admin":false},"created_at":"2016-08-11T07:47:02Z","updated_at":"2016-08-11T07:47:02Z","body":"@edd19 \r\nLa méthode remove_attachement n'est pas protégée : n'importe quel utilisateur peut supprimer un attachement par son id en fournissant l'url.\r\n- Remplacer le get par un post , de sorte que grace à {% csrftoken %} on ne puisse pas poster depuis autre part\r\n- Verifier que l'utilisateur à le droit de supprimer le fichier : soit c'est son fichier , soit c'est un admin (goupe admission_administrator à créer avec permission adéquate). Il faut utiliser user_pass_test , avec une redirection vers une page d'accès refusé.\r\n(@user_passes_test(lambda u: u.is_staff and u.has_perm('base.is_administrator'), login_url='/403/', redirect_field_name=None) => modifier la lamda pour correspondre au besoin)"}}
{"actor":{"display_login":"glamarca"}}