Skip to content
Merged
Show file tree
Hide file tree
Changes from 4 commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 12 additions & 0 deletions lms/djangoapps/course_api/tests/test_views.py
Original file line number Diff line number Diff line change
Expand Up @@ -250,6 +250,18 @@ def test_get_when_no_permission_then_filters_correctly(self):
ids = {c['course_id'] for c in response.json()['results']}
self.assertEqual(ids, {str(self.course.id)})

def test_filter_post(self):
"""Verify that CourseOverviews are filtered by the provided org key in a POST request."""
self.setup_user(self.staff_user)

# Create a second course to be filtered out of queries.
alternate_course = self.create_course(
org=md5(self.course.org.encode('utf-8')).hexdigest()
)

response = self.client.post(self.url, data={'course_keys': str(self.course.id)})
assert all((course['org'] == self.course.org) for course in response.json()['results'])


class CourseDetailViewTestCase(CourseApiTestViewMixin, SharedModuleStoreTestCase):
"""
Expand Down
11 changes: 10 additions & 1 deletion lms/djangoapps/course_api/views.py
Original file line number Diff line number Diff line change
Expand Up @@ -341,7 +341,10 @@ def get_queryset(self):
"""
Yield courses visible to the user.
"""
form = CourseListGetForm(self.request.query_params, initial={'requesting_user': self.request.user})
form = CourseListGetForm(
self.request.data if self.request.method == 'POST' else self.request.query_params,
initial={'requesting_user': self.request.user}
)
Comment on lines +344 to +355

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

       form_data = self.request.data if self.request.method == 'POST' else self.request.query_params
       form = CourseListGetForm(
            form_data,
            initial={'requesting_user': self.request.user}
        )

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would also suggest using standard if-else rather than inline.

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@viadanna, I think @xitij2000 as a point here, maybe a better solution could be.

form_data = self.request.query_params
if self.request.method == 'POST':
   form_data = self.request.data

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

what do you think?

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

if not form.is_valid():
raise ValidationError(form.errors)
return list_courses(
Expand All @@ -356,6 +359,12 @@ def get_queryset(self):
mobile_search=form.cleaned_data.get('mobile_search', False),
)

def post(self, request, *args, **kwargs):
Comment thread
viadanna marked this conversation as resolved.
"""
POST courses filter.
"""
return self.list(request, *args, **kwargs)


class CourseIdListUserThrottle(UserRateThrottle):
"""Limit the number of requests users can make to the course list id API."""
Expand Down