codeninjasllc/discourse
1
0
Fork 0
mirror of https://github.com/codeninjasllc/discourse.git synced 2024-11-27 09:36:19 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

FIX: users can see the raw email source of their own posts

Browse source
This commit is contained in:
Régis Hanol 2014-11-12 14:49:42 +01:00
parent fe541891fc
commit a036ac7bdc
3 changed files with 5 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
app/controllers/posts_controller.rb
View file

@ -31,8 +31,8 @@ class PostsController < ApplicationController
end end
def raw_email def raw_email
guardian.ensure_can_view_raw_email!
post = Post.find(params[:id].to_i) post = Post.find(params[:id].to_i)
guardian.ensure_can_view_raw_email!(post)
render json: {raw_email: post.raw_email} render json: {raw_email: post.raw_email}
end end

4
lib/guardian/post_guardian.rb
View file

@ -180,8 +180,8 @@ module PostGuardian
is_staff? is_staff?
end end
def can_view_raw_email? def can_view_raw_email?(post)
is_staff? post && (is_staff? || post.user_id == @user.id)
end end
def can_unhide?(post) def can_unhide?(post)

5
spec/controllers/posts_controller_spec.rb
View file

@ -72,8 +72,8 @@ describe PostsController do
include_examples "action requires login", :get, :raw_email, id: 2 include_examples "action requires login", :get, :raw_email, id: 2
describe "when logged in" do describe "when logged in" do
let(:user) {log_in} let(:user) { log_in }
let(:post) {Fabricate(:post, user: user, raw_email: 'email_content')} let(:post) { Fabricate(:post, user: user, raw_email: 'email_content') }
it "raises an error if the user doesn't have permission to view raw email" do it "raises an error if the user doesn't have permission to view raw email" do
Guardian.any_instance.expects(:can_view_raw_email?).returns(false) Guardian.any_instance.expects(:can_view_raw_email?).returns(false)
@ -90,7 +90,6 @@ describe PostsController do
response.should be_success response.should be_success
json = ::JSON.parse(response.body) json = ::JSON.parse(response.body)
json.should be_present
json['raw_email'].should == 'email_content' json['raw_email'].should == 'email_content'
end end