Fixed image delete permission issue
Also fixed missing translations and wrote tests to cover issue. Fixes #258
Showing
4 changed files
with
53 additions
and
2 deletions
| ... | @@ -405,7 +405,7 @@ class PermissionService | ... | @@ -405,7 +405,7 @@ class PermissionService |
| 405 | $action = end($explodedPermission); | 405 | $action = end($explodedPermission); |
| 406 | $this->currentAction = $action; | 406 | $this->currentAction = $action; |
| 407 | 407 | ||
| 408 | - $nonJointPermissions = ['restrictions']; | 408 | + $nonJointPermissions = ['restrictions', 'image', 'attachment']; |
| 409 | 409 | ||
| 410 | // Handle non entity specific jointPermissions | 410 | // Handle non entity specific jointPermissions |
| 411 | if (in_array($explodedPermission[0], $nonJointPermissions)) { | 411 | if (in_array($explodedPermission[0], $nonJointPermissions)) { |
| ... | @@ -421,7 +421,6 @@ class PermissionService | ... | @@ -421,7 +421,6 @@ class PermissionService |
| 421 | $this->currentAction = $permission; | 421 | $this->currentAction = $permission; |
| 422 | } | 422 | } |
| 423 | 423 | ||
| 424 | - | ||
| 425 | $q = $this->entityRestrictionQuery($baseQuery)->count() > 0; | 424 | $q = $this->entityRestrictionQuery($baseQuery)->count() > 0; |
| 426 | $this->clean(); | 425 | $this->clean(); |
| 427 | return $q; | 426 | return $q; | ... | ... |
| ... | @@ -59,4 +59,14 @@ $factory->define(BookStack\Tag::class, function ($faker) { | ... | @@ -59,4 +59,14 @@ $factory->define(BookStack\Tag::class, function ($faker) { |
| 59 | 'name' => $faker->city, | 59 | 'name' => $faker->city, |
| 60 | 'value' => $faker->sentence(3) | 60 | 'value' => $faker->sentence(3) |
| 61 | ]; | 61 | ]; |
| 62 | +}); | ||
| 63 | + | ||
| 64 | +$factory->define(BookStack\Image::class, function ($faker) { | ||
| 65 | + return [ | ||
| 66 | + 'name' => $faker->slug . '.jpg', | ||
| 67 | + 'url' => $faker->url, | ||
| 68 | + 'path' => $faker->url, | ||
| 69 | + 'type' => 'gallery', | ||
| 70 | + 'uploaded_to' => 0 | ||
| 71 | + ]; | ||
| 62 | }); | 72 | }); |
| ... | \ No newline at end of file | ... | \ No newline at end of file | ... | ... |
| ... | @@ -89,6 +89,7 @@ return [ | ... | @@ -89,6 +89,7 @@ return [ |
| 89 | * Chapters | 89 | * Chapters |
| 90 | */ | 90 | */ |
| 91 | 'chapter' => 'Chapter', | 91 | 'chapter' => 'Chapter', |
| 92 | + 'chapters' => 'Chapters', | ||
| 92 | 'chapters_popular' => 'Popular Chapters', | 93 | 'chapters_popular' => 'Popular Chapters', |
| 93 | 'chapters_new' => 'New Chapter', | 94 | 'chapters_new' => 'New Chapter', |
| 94 | 'chapters_create' => 'Create New Chapter', | 95 | 'chapters_create' => 'Create New Chapter', | ... | ... |
| ... | @@ -578,4 +578,45 @@ class RolesTest extends TestCase | ... | @@ -578,4 +578,45 @@ class RolesTest extends TestCase |
| 578 | ->see('Cannot be deleted'); | 578 | ->see('Cannot be deleted'); |
| 579 | } | 579 | } |
| 580 | 580 | ||
| 581 | + | ||
| 582 | + | ||
| 583 | + public function test_image_delete_own_permission() | ||
| 584 | + { | ||
| 585 | + $this->giveUserPermissions($this->user, ['image-update-all']); | ||
| 586 | +// $admin = $this->getAdmin(); | ||
| 587 | + $page = \BookStack\Page::first(); | ||
| 588 | + $image = factory(\BookStack\Image::class)->create(['uploaded_to' => $page->id, 'created_by' => $this->user->id, 'updated_by' => $this->user->id]); | ||
| 589 | + | ||
| 590 | + $this->actingAs($this->user)->json('delete', '/images/' . $image->id) | ||
| 591 | + ->seeStatusCode(403); | ||
| 592 | + | ||
| 593 | + $this->giveUserPermissions($this->user, ['image-delete-own']); | ||
| 594 | + | ||
| 595 | + $this->actingAs($this->user)->json('delete', '/images/' . $image->id) | ||
| 596 | + ->seeStatusCode(200) | ||
| 597 | + ->dontSeeInDatabase('images', ['id' => $image->id]); | ||
| 598 | + } | ||
| 599 | + | ||
| 600 | + public function test_image_delete_all_permission() | ||
| 601 | + { | ||
| 602 | + $this->giveUserPermissions($this->user, ['image-update-all']); | ||
| 603 | + $admin = $this->getAdmin(); | ||
| 604 | + $page = \BookStack\Page::first(); | ||
| 605 | + $image = factory(\BookStack\Image::class)->create(['uploaded_to' => $page->id, 'created_by' => $admin->id, 'updated_by' => $admin->id]); | ||
| 606 | + | ||
| 607 | + $this->actingAs($this->user)->json('delete', '/images/' . $image->id) | ||
| 608 | + ->seeStatusCode(403); | ||
| 609 | + | ||
| 610 | + $this->giveUserPermissions($this->user, ['image-delete-own']); | ||
| 611 | + | ||
| 612 | + $this->actingAs($this->user)->json('delete', '/images/' . $image->id) | ||
| 613 | + ->seeStatusCode(403); | ||
| 614 | + | ||
| 615 | + $this->giveUserPermissions($this->user, ['image-delete-all']); | ||
| 616 | + | ||
| 617 | + $this->actingAs($this->user)->json('delete', '/images/' . $image->id) | ||
| 618 | + ->seeStatusCode(200) | ||
| 619 | + ->dontSeeInDatabase('images', ['id' => $image->id]); | ||
| 620 | + } | ||
| 621 | + | ||
| 581 | } | 622 | } | ... | ... |
-
Please register or sign in to post a comment