From fe35f1e9bd317b2f4de7452f19ed5643fd6ce2d5 Mon Sep 17 00:00:00 2001 From: sahil839 Date: Wed, 24 Jun 2020 17:46:29 +0530 Subject: [PATCH] invites: Do not return multi-use invites to non-admin users. This commit changes do_get_user_invites function to not return multiuse invites to non-admin users. We should only return multiuse invites to admins, as we only allow admins to create them. --- zerver/lib/actions.py | 4 ++++ zerver/tests/test_signup.py | 4 +++- 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/zerver/lib/actions.py b/zerver/lib/actions.py index ab4fd0c2f8..bebf190788 100644 --- a/zerver/lib/actions.py +++ b/zerver/lib/actions.py @@ -5235,6 +5235,10 @@ def do_get_user_invites(user_profile: UserProfile) -> List[Dict[str, Any]]: invited_as=invitee.invited_as, is_multiuse=False)) + if not user_profile.is_realm_admin: + # We do not return multiuse invites to non-admin users. + return invites + lowest_datetime = timezone_now() - datetime.timedelta(days=settings.INVITATION_LINK_VALIDITY_DAYS) multiuse_confirmation_objs = Confirmation.objects.filter(realm=user_profile.realm, type=Confirmation.MULTIUSE_INVITE, diff --git a/zerver/tests/test_signup.py b/zerver/tests/test_signup.py index b2b8f10090..c6b2118623 100644 --- a/zerver/tests/test_signup.py +++ b/zerver/tests/test_signup.py @@ -1621,7 +1621,9 @@ class InvitationsTestCase(InviteUserBase): prereg_user_other_realm = PreregistrationUser( email="TestOne@zulip.com", referred_by=self.mit_user("sipbtest")) prereg_user_other_realm.save() - self.assertEqual(len(do_get_user_invites(user_profile)), 4) + multiuse_invite = MultiuseInvite.objects.create(referred_by=user_profile, realm=user_profile.realm) + create_confirmation_link(multiuse_invite, Confirmation.MULTIUSE_INVITE) + self.assertEqual(len(do_get_user_invites(user_profile)), 5) self.assertEqual(len(do_get_user_invites(hamlet)), 1) self.assertEqual(len(do_get_user_invites(othello)), 1)