mirror of
https://gh.wpcy.net/https://github.com/discourse/discourse.git
synced 2026-05-05 00:44:53 +08:00
4e871f46da
The `update` and `destroy` actions in `InviteesController` were missing post visibility and event open-state (closed/expired) checks that the `create` action already enforced. This allowed users to mutate attendance on events they couldn't see or that were no longer accepting changes. This fix has been made as part of refactoring the three actions into services (`CreateInvitee`, `UpdateInvitee`, `DestroyInvitee`) with declarative policy steps for consistent authorization.
56 lines
1.5 KiB
Ruby
56 lines
1.5 KiB
Ruby
# frozen_string_literal: true
|
|
|
|
Fabricator(:event, from: "DiscoursePostEvent::Event") do
|
|
transient :user
|
|
|
|
post do |attrs|
|
|
if attrs[:post]
|
|
attrs[:post]
|
|
else
|
|
user = attrs[:user] || Fabricate(:user, admin: true, refresh_auto_groups: true)
|
|
topic = attrs[:topic] || Fabricate(:topic, user:, category: Fabricate(:category))
|
|
Fabricate(:post, user:, topic:)
|
|
end
|
|
end
|
|
|
|
id { |attrs| attrs[:post].id }
|
|
|
|
status do |attrs|
|
|
if attrs[:status]
|
|
DiscoursePostEvent::Event.statuses[attrs[:status]]
|
|
else
|
|
DiscoursePostEvent::Event.statuses[:public]
|
|
end
|
|
end
|
|
original_starts_at { |attrs| attrs[:original_starts_at] || 1.day.from_now.iso8601 }
|
|
original_ends_at { |attrs| attrs[:original_ends_at] }
|
|
end
|
|
|
|
Fabricator(:private_event, from: :event) do
|
|
transient :group
|
|
|
|
post do |attrs|
|
|
group = attrs[:group] || Fabricate(:group)
|
|
category = Fabricate(:private_category, group:)
|
|
user = attrs[:user] || Fabricate(:user, admin: true, refresh_auto_groups: true)
|
|
topic = Fabricate(:topic, user:, category:)
|
|
Fabricate(:post, user:, topic:)
|
|
end
|
|
end
|
|
|
|
Fabricator(:event_date, from: "DiscoursePostEvent::EventDate") do
|
|
event
|
|
|
|
starts_at { |attrs| attrs[:starts_at] || 1.day.from_now.iso8601 }
|
|
ends_at { |attrs| attrs[:ends_at] }
|
|
end
|
|
|
|
def create_post_with_event(user, extra_raw = "")
|
|
start = (Time.now - 10.seconds).utc.iso8601(3)
|
|
|
|
PostCreator.create!(
|
|
user,
|
|
title: "Sell a boat party ##{SecureRandom.alphanumeric}",
|
|
raw: "[event start=\"#{start}\" #{extra_raw}]\n[/event]",
|
|
).reload
|
|
end
|
