mirror of
https://github.com/discourse/discourse.git
synced 2026-08-07 13:19:19 +08:00
08eacfdb87
`ReviewableQueuedPostSerializer` unconditionally included `payload["raw_email"]` for posts that arrived via incoming email. Category moderation group members reaching the review queue could therefore read the full inbound email source without being in `view_raw_email_allowed_groups`. The serializer now redacts `raw_email` from the rendered payload unless the current user is in `view_raw_email_allowed_groups`, mirroring the existing check used by `Guardian#can_view_raw_email`. This commit also: - disables click on envelope when user has no raw email access to prevent a deceptive action - adds a new `guardian.can_view_raw_emails?` to avoid duplication of this specific logic https://github.com/discourse/discourse/security/advisories/GHSA-h2jr-whpx-6w63
111 lines
3.4 KiB
Ruby
Vendored
111 lines
3.4 KiB
Ruby
Vendored
# frozen_string_literal: true
|
|
|
|
RSpec.describe ReviewableQueuedPostSerializer do
|
|
fab!(:admin)
|
|
|
|
describe "new topic" do
|
|
fab!(:reviewable, :reviewable_queued_post_topic)
|
|
|
|
it "allows us to edit category / title" do
|
|
json =
|
|
ReviewableQueuedPostSerializer.new(
|
|
reviewable,
|
|
scope: Guardian.new(admin),
|
|
root: nil,
|
|
).as_json
|
|
|
|
payload = json[:payload]
|
|
expect(payload["raw"]).to eq("hello world post contents.")
|
|
expect(payload["title"]).to eq("queued post title")
|
|
expect(payload["tags"]).to eq(%w[cool neat])
|
|
expect(json[:topic_id]).to be_blank
|
|
expect(json[:can_edit]).to eq(true)
|
|
|
|
fields = json[:editable_fields]
|
|
expect(fields).to be_present
|
|
|
|
category_field = fields.find { |f| f[:id] == "category_id" }
|
|
expect(category_field).to be_present
|
|
expect(category_field[:type]).to eq(:category)
|
|
|
|
title_field = fields.find { |f| f[:id] == "payload.title" }
|
|
expect(title_field).to be_present
|
|
expect(title_field[:type]).to eq(:text)
|
|
|
|
raw_field = fields.find { |f| f[:id] == "payload.raw" }
|
|
expect(raw_field).to be_present
|
|
expect(raw_field[:type]).to eq(:editor)
|
|
|
|
tags_field = fields.find { |f| f[:id] == "payload.tags" }
|
|
expect(tags_field).to be_present
|
|
expect(tags_field[:type]).to eq(:tags)
|
|
end
|
|
end
|
|
|
|
describe "reply to an existing topic" do
|
|
fab!(:reviewable, :reviewable_queued_post)
|
|
|
|
it "includes correct user fields" do
|
|
json =
|
|
ReviewableQueuedPostSerializer.new(
|
|
reviewable,
|
|
scope: Guardian.new(admin),
|
|
root: nil,
|
|
).as_json
|
|
|
|
payload = json[:payload]
|
|
|
|
expect(payload["raw"]).to eq("hello world post contents.")
|
|
expect(payload["title"]).to be_blank
|
|
expect(payload["via_email"]).to eq(true)
|
|
expect(payload["raw_email"]).to eq("store_me")
|
|
expect(json[:topic_id]).to eq(reviewable.topic_id)
|
|
expect(json[:topic_url]).to eq(reviewable.topic.url)
|
|
expect(json[:can_edit]).to eq(true)
|
|
|
|
fields = json[:editable_fields]
|
|
expect(fields).to be_present
|
|
|
|
expect(fields.any? { |f| f[:id] == "payload.title" }).to eq(false)
|
|
expect(fields.any? { |f| f[:id] == "category_id" }).to eq(false)
|
|
|
|
raw_field = fields.find { |f| f[:id] == "payload.raw" }
|
|
expect(raw_field).to be_present
|
|
expect(raw_field[:type]).to eq(:editor)
|
|
end
|
|
end
|
|
|
|
describe "raw email visibility" do
|
|
fab!(:reviewable, :reviewable_queued_post)
|
|
fab!(:user)
|
|
fab!(:group)
|
|
fab!(:group_user) { Fabricate(:group_user, group: group, user: user) }
|
|
|
|
def serialized_payload(scope_user)
|
|
ReviewableQueuedPostSerializer.new(
|
|
reviewable,
|
|
scope: Guardian.new(scope_user),
|
|
root: nil,
|
|
).as_json[
|
|
:payload
|
|
]
|
|
end
|
|
|
|
it "redacts raw_email when the user is not in view_raw_email_allowed_groups" do
|
|
SiteSetting.view_raw_email_allowed_groups = Group::AUTO_GROUPS[:admins].to_s
|
|
|
|
payload = serialized_payload(user)
|
|
|
|
expect(payload["via_email"]).to eq(true)
|
|
expect(payload).not_to have_key("raw_email")
|
|
end
|
|
|
|
it "exposes raw_email when the user is in view_raw_email_allowed_groups" do
|
|
SiteSetting.view_raw_email_allowed_groups = "#{Group::AUTO_GROUPS[:admins]}|#{group.id}"
|
|
|
|
payload = serialized_payload(user)
|
|
|
|
expect(payload["raw_email"]).to eq("store_me")
|
|
end
|
|
end
|
|
end
|
