mirror of
https://github.com/discourse/discourse.git
synced 2026-08-12 04:31:29 +08:00
4b9ee0bc05
The suspend/silence endpoint accepted an arbitrary post_id with post_action "edit". Because the edit action had no guardian check, a moderator could target any static doc post (ToS, guidelines, privacy policy) — posts moderators are explicitly blocked from editing — even ones unrelated to the user being suspended. Add the missing can_edit_post? guardian check to the edit action, consistent with the existing checks on delete and delete_replies.
104 lines
2.8 KiB
Ruby
Vendored
104 lines
2.8 KiB
Ruby
Vendored
# frozen_string_literal: true
|
|
|
|
RSpec.describe User::Action::TriggerPostAction do
|
|
describe ".call" do
|
|
subject(:action) { described_class.call(guardian:, post:, params:) }
|
|
|
|
fab!(:post)
|
|
fab!(:admin)
|
|
|
|
let(:guardian) { admin.guardian }
|
|
let(:params) { User::Suspend::Contract.new(post_action:, post_edit:) }
|
|
let(:post_action) { nil }
|
|
let(:post_edit) { nil }
|
|
|
|
context "when post is blank" do
|
|
let(:post) { nil }
|
|
|
|
it "does nothing" do
|
|
expect { action }.not_to change { Post.count }
|
|
end
|
|
end
|
|
|
|
context "when post_action is blank" do
|
|
it "does nothing" do
|
|
expect { action }.not_to change { Post.count }
|
|
end
|
|
end
|
|
|
|
context "when post_action is 'none'" do
|
|
let(:post_action) { "none" }
|
|
it "does nothing" do
|
|
expect { action }.not_to change { Post.count }
|
|
end
|
|
end
|
|
|
|
context "when post and post_action are defined" do
|
|
context "when post_action is 'delete'" do
|
|
let(:post_action) { "delete" }
|
|
|
|
context "when user cannot delete a post" do
|
|
let(:guardian) { Guardian.new }
|
|
|
|
it "does nothing" do
|
|
expect { action }.not_to change { Post.count }
|
|
end
|
|
end
|
|
|
|
context "when user can delete a post" do
|
|
it "deletes the provided post" do
|
|
expect { action }.to change { Post.where(id: post.id).count }.by(-1)
|
|
end
|
|
end
|
|
end
|
|
|
|
context "when post_action is 'delete_replies'" do
|
|
let(:post_action) { "delete_replies" }
|
|
|
|
context "when user cannot delete a post" do
|
|
let(:guardian) { Guardian.new }
|
|
|
|
it "does nothing" do
|
|
expect { action }.not_to change { Post.count }
|
|
end
|
|
end
|
|
|
|
context "when user can delete a post" do
|
|
fab!(:reply) do
|
|
Fabricate(:reply, topic: post.topic, reply_to_post_number: post.post_number)
|
|
end
|
|
|
|
before { post.replies << reply }
|
|
|
|
it "deletes the provided post" do
|
|
expect { action }.to change { Post.where(id: post.id).count }.by(-1)
|
|
end
|
|
|
|
it "deletes the post's replies" do
|
|
expect { action }.to change { Post.where(id: reply.id).count }.by(-1)
|
|
end
|
|
end
|
|
end
|
|
|
|
context "when post_action is 'edit'" do
|
|
let(:post_action) { "edit" }
|
|
let(:post_edit) { "blabla" }
|
|
|
|
context "when user cannot edit a post" do
|
|
fab!(:regular_user, :user)
|
|
let(:guardian) { regular_user.guardian }
|
|
|
|
it "does nothing" do
|
|
expect { action }.not_to change { post.reload.raw }
|
|
end
|
|
end
|
|
|
|
context "when user can edit a post" do
|
|
it "edits the post with what the moderator wrote" do
|
|
expect { action }.to change { post.reload.raw }.to eq("blabla")
|
|
end
|
|
end
|
|
end
|
|
end
|
|
end
|
|
end
|
