Skip to content

Conversation

@ft-mammoo
Copy link

This pull request addresses Issue #821 by implementing the necessary logic to restrict the manual attendance (clock-in/clock-out) feature based on user permission.

The goal is to ensure only authorized personnel who possess the specific permission can utilize the feature.

Changes Implemented:

  1. Permission Check: The security check (if not request.user.has_perm('attendance.can_manual_login_logout'):) was added to the beginning of both the clock_in and clock_out views.
  2. File Modified: All security logic was implemented in the correct file: attendance/views/clock_in_out.py.
  3. HTMX Response: The denial response status code was intentionally set to 200 (OK) instead of 403 (Forbidden) to ensure HTMX successfully renders the custom denial message (Manual Attendance Restricted) on the Navbar without the button disappearing.

Verification (Testing):

  • Success Case Confirmed: A user with the attendance.can_manual_login_logout permission can successfully use both the Check-In and Check-Out buttons.
  • Denial Case Confirmed: A Regular User (non-superuser, without the permission) is correctly blocked by the backend and visually presented with the "Manual Attendance Restricted" message upon clicking the button.

Closes Issue #821.

… Restricts access to users with 'attendance.can_manual_login_logout' permission, resolving Issue horilla-opensource#821.
@gitguardian
Copy link

gitguardian bot commented Oct 22, 2025

️✅ There are no secrets present in this pull request anymore.

If these secrets were true positive and are still valid, we highly recommend you to revoke them.
While these secrets were previously flagged, we no longer have a reference to the
specific commits where they were detected. Once a secret has been leaked into a git
repository, you should consider it compromised, even if it was deleted immediately.
Find here more information about risks.


🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.

@ft-mammoo ft-mammoo force-pushed the feature/issue-821-manual-attendance-restriction branch from 53311e0 to be056f3 Compare October 22, 2025 16:20
@ft-mammoo ft-mammoo marked this pull request as draft November 17, 2025 03:38
@ft-mammoo ft-mammoo marked this pull request as ready for review November 17, 2025 03:39
@ft-mammoo ft-mammoo marked this pull request as draft November 24, 2025 05:30
@ft-mammoo ft-mammoo marked this pull request as ready for review November 24, 2025 05:31
@ft-mammoo ft-mammoo marked this pull request as draft November 24, 2025 05:31
@ft-mammoo ft-mammoo marked this pull request as ready for review November 24, 2025 05:32
Copy link
Author

@ft-mammoo ft-mammoo left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ready For Review

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant