dashboard: remove redirection in templates, rewrite group tests

circle/dashboard/templates/dashboard/group-detail.html

@@ -40,7 +40,7 @@
      <thead><tr><th></th><th>{% trans "Who" %}</th><th></th><th></th></tr></thead>
         {% for i in users %}
 	<tr><td><i class="icon-user"></i></td><td>{{i.username}}</td>
-		<td><a data-group_pk="{{ group.pk }}" data-member_pk="{{i.pk}}" href="{% url "dashboard.views.remove-user" member_pk=i.pk group_pk=group.pk %}?next={{ request.path }}" class="real-link delete-from-group btn btn-link btn-xs"><i class="icon-remove"><span class="sr-only">{% trans "remove" %}</span></i></a></td></tr>
+		<td><a data-group_pk="{{ group.pk }}" data-member_pk="{{i.pk}}" href="{% url "dashboard.views.remove-user" member_pk=i.pk group_pk=group.pk %}" class="real-link delete-from-group btn btn-link btn-xs"><i class="icon-remove"><span class="sr-only">{% trans "remove" %}</span></i></a></td></tr>
         {% endfor %}
         <tr><td><i class="icon-plus"></i></td>
             <td><input type="text" class="form-control" name="list-new-name"
@@ -67,7 +67,7 @@
                     <option{%if id = i.level%} selected="selected"{%endif%} value="{{id}}">{{name}}</option>
                     {% endfor %}
             </select></td>
-	    <td class="user-remove"><a data-group_pk="{{ group.pk }}" data-member_pk="{{i.user.pk }}" href="{% url "dashboard.views.remove-acluser" member_pk=i.user.pk group_pk=group.pk %}?next={{ request.path }}" class="real-link delete-from-group btn btn-link btn-xs"><i class="icon-remove"><span class="sr-only">{% trans "remove" %}</span></i></a></td></tr>
+	    <td class="user-remove"><a data-group_pk="{{ group.pk }}" data-member_pk="{{i.user.pk }}" href="{% url "dashboard.views.remove-acluser" member_pk=i.user.pk group_pk=group.pk %}" class="real-link delete-from-group btn btn-link btn-xs"><i class="icon-remove"><span class="sr-only">{% trans "remove" %}</span></i></a></td></tr>
         {% endfor %}
         {% for i in acl.groups %}
         <tr><td><i class="icon-user"></i></td><td>{{ i.group }}</td>
@@ -76,7 +76,7 @@
                     <option{%if id = i.level%} selected="selected"{%endif%} value="{{id}}">{{name}}</option>
                     {% endfor %}
             </select></td>
-	    <td class="user-remove"><a data-group_pk="{{ i.pk }}"data-member_pk="{{i.group.pk }}" href="{% url "dashboard.views.remove-aclgroup" member_pk=i.group.pk group_pk=group.pk %}?next={{ request.path }}" class="real-link delete-from-group btn btn-link btn-xs"><i class="icon-remove"><span class="sr-only">{% trans "remove" %}</span></i></a></td></tr>
+	    <td class="user-remove"><a data-group_pk="{{ i.pk }}"data-member_pk="{{i.group.pk }}" href="{% url "dashboard.views.remove-aclgroup" member_pk=i.group.pk group_pk=group.pk %}" class="real-link delete-from-group btn btn-link btn-xs"><i class="icon-remove"><span class="sr-only">{% trans "remove" %}</span></i></a></td></tr>
         {% endfor %}
         <tr><td><i class="icon-plus"></i></td>
             <td><input type="text" class="form-control" name="perm-new-name"

circle/dashboard/views.py

@@ -962,10 +962,11 @@ class GroupList(LoginRequiredMixin, SuperuserRequiredMixin, SingleTableView):
     table_pagination = False
 
 
-class GroupRemoveUserView(LoginRequiredMixin, DeleteView):
+class GroupRemoveUserView(CheckedDetailView, DeleteView):
     model = Group
     slug_field = 'pk'
     slug_url_kwarg = 'group_pk'
+    read_level = 'operator'
 
     def get_context_data(self, **kwargs):
         context = super(GroupRemoveUserView, self).get_context_data(**kwargs)
@@ -1001,6 +1002,9 @@ class GroupRemoveUserView(LoginRequiredMixin, DeleteView):
         return _("Member successfully removed from group!")
 
     def delete(self, request, *args, **kwargs):
+        object = self.get_object()
+        if not object.profile.has_level(request.user, 'operator'):
+            raise PermissionDenied()
         self.remove_member(kwargs["member_pk"])
         success_url = self.get_success_url()
         success_message = self.get_success_message()