Dan Brown

Fixed image delete permission issue

Also fixed missing translations and wrote tests to cover issue.
Fixes #258
...@@ -405,7 +405,7 @@ class PermissionService ...@@ -405,7 +405,7 @@ class PermissionService
405 $action = end($explodedPermission); 405 $action = end($explodedPermission);
406 $this->currentAction = $action; 406 $this->currentAction = $action;
407 407
408 - $nonJointPermissions = ['restrictions']; 408 + $nonJointPermissions = ['restrictions', 'image', 'attachment'];
409 409
410 // Handle non entity specific jointPermissions 410 // Handle non entity specific jointPermissions
411 if (in_array($explodedPermission[0], $nonJointPermissions)) { 411 if (in_array($explodedPermission[0], $nonJointPermissions)) {
...@@ -421,7 +421,6 @@ class PermissionService ...@@ -421,7 +421,6 @@ class PermissionService
421 $this->currentAction = $permission; 421 $this->currentAction = $permission;
422 } 422 }
423 423
424 -
425 $q = $this->entityRestrictionQuery($baseQuery)->count() > 0; 424 $q = $this->entityRestrictionQuery($baseQuery)->count() > 0;
426 $this->clean(); 425 $this->clean();
427 return $q; 426 return $q;
......
...@@ -59,4 +59,14 @@ $factory->define(BookStack\Tag::class, function ($faker) { ...@@ -59,4 +59,14 @@ $factory->define(BookStack\Tag::class, function ($faker) {
59 'name' => $faker->city, 59 'name' => $faker->city,
60 'value' => $faker->sentence(3) 60 'value' => $faker->sentence(3)
61 ]; 61 ];
62 +});
63 +
64 +$factory->define(BookStack\Image::class, function ($faker) {
65 + return [
66 + 'name' => $faker->slug . '.jpg',
67 + 'url' => $faker->url,
68 + 'path' => $faker->url,
69 + 'type' => 'gallery',
70 + 'uploaded_to' => 0
71 + ];
62 }); 72 });
...\ No newline at end of file ...\ No newline at end of file
......
...@@ -89,6 +89,7 @@ return [ ...@@ -89,6 +89,7 @@ return [
89 * Chapters 89 * Chapters
90 */ 90 */
91 'chapter' => 'Chapter', 91 'chapter' => 'Chapter',
92 + 'chapters' => 'Chapters',
92 'chapters_popular' => 'Popular Chapters', 93 'chapters_popular' => 'Popular Chapters',
93 'chapters_new' => 'New Chapter', 94 'chapters_new' => 'New Chapter',
94 'chapters_create' => 'Create New Chapter', 95 'chapters_create' => 'Create New Chapter',
......
...@@ -578,4 +578,45 @@ class RolesTest extends TestCase ...@@ -578,4 +578,45 @@ class RolesTest extends TestCase
578 ->see('Cannot be deleted'); 578 ->see('Cannot be deleted');
579 } 579 }
580 580
581 +
582 +
583 + public function test_image_delete_own_permission()
584 + {
585 + $this->giveUserPermissions($this->user, ['image-update-all']);
586 +// $admin = $this->getAdmin();
587 + $page = \BookStack\Page::first();
588 + $image = factory(\BookStack\Image::class)->create(['uploaded_to' => $page->id, 'created_by' => $this->user->id, 'updated_by' => $this->user->id]);
589 +
590 + $this->actingAs($this->user)->json('delete', '/images/' . $image->id)
591 + ->seeStatusCode(403);
592 +
593 + $this->giveUserPermissions($this->user, ['image-delete-own']);
594 +
595 + $this->actingAs($this->user)->json('delete', '/images/' . $image->id)
596 + ->seeStatusCode(200)
597 + ->dontSeeInDatabase('images', ['id' => $image->id]);
598 + }
599 +
600 + public function test_image_delete_all_permission()
601 + {
602 + $this->giveUserPermissions($this->user, ['image-update-all']);
603 + $admin = $this->getAdmin();
604 + $page = \BookStack\Page::first();
605 + $image = factory(\BookStack\Image::class)->create(['uploaded_to' => $page->id, 'created_by' => $admin->id, 'updated_by' => $admin->id]);
606 +
607 + $this->actingAs($this->user)->json('delete', '/images/' . $image->id)
608 + ->seeStatusCode(403);
609 +
610 + $this->giveUserPermissions($this->user, ['image-delete-own']);
611 +
612 + $this->actingAs($this->user)->json('delete', '/images/' . $image->id)
613 + ->seeStatusCode(403);
614 +
615 + $this->giveUserPermissions($this->user, ['image-delete-all']);
616 +
617 + $this->actingAs($this->user)->json('delete', '/images/' . $image->id)
618 + ->seeStatusCode(200)
619 + ->dontSeeInDatabase('images', ['id' => $image->id]);
620 + }
621 +
581 } 622 }
......