Normalize portal kinds before checking feature access

2026-09-11 12:32:51 +12:00
parent ec0a866ef3
commit df6fe58278
2 changed files with 18 additions and 2 deletions
@@ -108,3 +108,13 @@ class FeatureAccessTests(TempDatabaseMixin, unittest.TestCase):
            with self.assertRaises(StopAsyncIteration):
                await anext(iterator)
        asyncio.run(scenario())
+
+    def test_legacy_portal_kind_normalization_cannot_bypass_permissions(self):
+        update_permissions({'requests': False, 'new_requests': False, 'issues': True}, self.user['username'])
+        for kind in ['request', 'REQUEST', ' Request ', ' ', '']:
+            with self.subTest(kind=kind):
+                self.assertEqual(self.client.get('/portal/items', params={'kind': kind}).status_code, 403)
+                self.assertEqual(self.client.get('/portal/overview', params={'kind': kind}).status_code, 403)
+                self.assertEqual(self.client.post('/portal/items', json={'kind': kind}).status_code, 403)
+        self.assertEqual(self.client.post('/portal/items', json={'kind': None}).status_code, 403)
+        self.assertEqual(self.client.post('/portal/items', json={}).status_code, 403)