Merge branch 'release/v2.2'

Harvard-University-iCommons · Aug 11, 2021 · 2602560 · 2602560
2 parents ca6621b + b22a355
commit 2602560
Show file tree

Hide file tree

Showing 3 changed files with 9 additions and 9 deletions.
diff --git a/lti_emailer/requirements/base.txt b/lti_emailer/requirements/base.txt
@@ -14,4 +14,4 @@ git+ssh://[email protected]/penzance/[email protected]#egg=canvas-python-s
 git+ssh://[email protected]/Harvard-University-iCommons/[email protected]#egg=django-icommons-common==2.0.2
 git+ssh://[email protected]/Harvard-University-iCommons/[email protected]#egg=django-icommons-ui==2.0
 git+ssh://[email protected]/Harvard-University-iCommons/[email protected]#egg=django-auth-lti==2.0.1
-git+https://github.com/Harvard-University-iCommons/django-ssm-parameter-store.git@v0.2#egg=django-ssm-parameter-store==0.2
+git+https://github.com/Harvard-University-iCommons/django-ssm-parameter-store.git@v0.3#egg=django-ssm-parameter-store==0.3
diff --git a/mailing_list/api.py b/mailing_list/api.py
@@ -6,6 +6,7 @@
 from django.contrib.auth.decorators import login_required
 from django.utils import timezone
 from django.core.cache import cache
+from django.core.exceptions import PermissionDenied
 
 from django_auth_lti.decorators import lti_role_required
 from django_auth_lti import const
@@ -62,9 +63,15 @@ def set_access_level(request, mailing_list_id):
     :param mailing_list_id:
     :return: JSON response containing the updated mailing list data
     """
+    ACCESS_LEVELS = ('staff', 'members', 'readonly')
+
+    access_level = json.loads(request.body)['access_level']
+    if access_level not in ACCESS_LEVELS:
+        logger.warn(f"{access_level} not a valid access_level. Mailing list {mailing_list_id} not modified.")
+        raise PermissionDenied
+
     try:
         logged_in_user_id = request.LTI['lis_person_sourcedid']
-        access_level = json.loads(request.body)['access_level']
 
         mailing_list = MailingList.objects.get(id=mailing_list_id)
         mailing_list.modified_by = logged_in_user_id

diff --git a/mailing_list/static/mailing_list/js/app.js b/mailing_list/static/mailing_list/js/app.js
@@ -68,13 +68,6 @@
         class: 'all members of this course can email each other; students and guests <strong>can</strong> send and reply to this mailing list.',
         section: 'all members of this section and all staff can email each other; students and guests <strong>can</strong> send and reply to this mailing list.'
       }
-    },{
-      id: 'everyone',
-      name: {class: 'World Access:', section: 'World Access:'},
-      description: {
-        class: 'anyone can send and reply to this mailing list.',
-        section: 'anyone can send and reply to this mailing list.'
-      }
     },{
       id: 'readonly',
       name: {class: 'Disabled:', section: 'Disabled:'},