mirror of
https://ghfast.top/https://github.com/discourse/discourse-akismet.git
synced 2026-07-15 11:36:24 +08:00
a88227e75b
Some checks failed
Discourse Plugin / ci (push) Has been cancelled
## Summary Moderators did not respect the `moderators_view_emails` site setting allowing them to view user email addresses by viewing Akismet user reviews in the review queue. ## Source - Patch Triage: https://patch.discourse.org/patch-triage/1223 Co-authored-by: discourse-patch-triage <272280883+discourse-patch-triage[bot]@users.noreply.github.com>
29 lines
770 B
Ruby
29 lines
770 B
Ruby
# frozen_string_literal: true
|
|
|
|
RSpec.describe ReviewablesController do
|
|
fab!(:moderator)
|
|
fab!(:reviewable, :reviewable_akismet_user)
|
|
|
|
before do
|
|
SiteSetting.akismet_enabled = true
|
|
SiteSetting.moderators_view_emails = false
|
|
|
|
sign_in(moderator)
|
|
end
|
|
|
|
describe "#show" do
|
|
it "filters the email payload by reviewer permission" do
|
|
get "/review/#{reviewable.id}.json"
|
|
|
|
expect(response.status).to eq(200)
|
|
expect(response.parsed_body["reviewable"]["payload"]).not_to have_key("email")
|
|
|
|
SiteSetting.moderators_view_emails = true
|
|
|
|
get "/review/#{reviewable.id}.json"
|
|
|
|
expect(response.status).to eq(200)
|
|
expect(response.parsed_body["reviewable"]["payload"]["email"]).to eq(reviewable.target.email)
|
|
end
|
|
end
|
|
end
|
