Feed articles are listed even in private profiles

The access to the feed must be controlled by the content viewer access logic, not by the feed. P.S.: I'm not pretty sure if my solution have performance issues! (ActionItem1619)

Feed articles are listed even in private profiles
The access to the feed must be controlled by the content viewer access logic, not by the feed. P.S.: I'm not pretty sure if my solution have performance issues! (ActionItem1619)
Rodrigo Souto · Antonio Terceiro
1 parent 8f09db6a
Showing 3 changed files with 32 additions and 4 deletions Show diff stats
app/models/profile.rb
app/models/rss_feed.rb
test/unit/rss_feed_test.rb
@@ -332,6 +332,16 @@ class Profile &lt; ActiveRecord::Base
     self.articles.recent(limit, options)
   end
+  def last_articles(limit = 10, options = {})
+    options = { :limit => limit,
+                :conditions => ["advertise = ? AND published = ? AND
+                                 ((articles.type != ? and articles.type != ? and articles.type != ?) OR
+                                 articles.type is NULL)",
+                                 true, true, 'UploadedFile', 'RssFeed', 'Blog'],
+                :order => 'articles.published_at desc, articles.id desc' }.merge(options)
+    self.articles.find(:all, options)
+  end
+
   class << self
     # finds a profile by its identifier. This method is a shortcut to
@@ -68,7 +68,7 @@ class RssFeed &lt; Article
       if (self.include == 'parent_and_children') && self.parent
         self.parent.map_traversal
       else
-        profile.recent_documents(self.limit)
+        profile.last_articles(self.limit)
       end
   end
   def data
@@ -58,7 +58,7 @@ class RssFeedTest &lt; Test::Unit::TestCase
     feed = RssFeed.new
     feed.expects(:profile).returns(profile).at_least_once
     array = []
-    profile.expects(:recent_documents).returns(array)
+    profile.expects(:last_articles).returns(array)
     feed.data
   end
@@ -150,11 +150,11 @@ class RssFeedTest &lt; Test::Unit::TestCase
     feed.profile = profile
     feed.save!
-    feed.profile.expects(:recent_documents).with(10).returns([]).once
+    feed.profile.expects(:last_articles).with(10).returns([]).once
     feed.data
     feed.limit = 5
-    feed.profile.expects(:recent_documents).with(5).returns([]).once
+    feed.profile.expects(:last_articles).with(5).returns([]).once
     feed.data
   end
@@ -218,4 +218,22 @@ class RssFeedTest &lt; Test::Unit::TestCase
     assert_match published_article.to_html, feed.data
   end
+  should 'display articles even within a private profile' do
+    profile = create_user('testuser').person
+    profile.public_profile = false
+    profile.save!
+    a1 = profile.articles.build(:name => 'article 1'); a1.save!
+    a2 = profile.articles.build(:name => 'article 2'); a2.save!
+    a3 = profile.articles.build(:name => 'article 3'); a3.save!
+
+    feed = RssFeed.new(:name => 'testfeed')
+    feed.profile = profile
+    feed.save!
+
+    rss = feed.data
+    assert_match /<item><title>article 1<\/title>/, rss
+    assert_match /<item><title>article 2<\/title>/, rss
+    assert_match /<item><title>article 3<\/title>/, rss
+  end
+
 end
	@@ -332,6 +332,16 @@ class Profile < ActiveRecord::Base		@@ -332,6 +332,16 @@ class Profile < ActiveRecord::Base
332	self.articles.recent(limit, options)	332	self.articles.recent(limit, options)
333	end	333	end
334		334
		335	+ def last_articles(limit = 10, options = {})
		336	+ options = { :limit => limit,
		337	+ :conditions => ["advertise = ? AND published = ? AND
		338	+ ((articles.type != ? and articles.type != ? and articles.type != ?) OR
		339	+ articles.type is NULL)",
		340	+ true, true, 'UploadedFile', 'RssFeed', 'Blog'],
		341	+ :order => 'articles.published_at desc, articles.id desc' }.merge(options)
		342	+ self.articles.find(:all, options)
		343	+ end
		344	+
335	class << self	345	class << self
336		346
337	# finds a profile by its identifier. This method is a shortcut to	347	# finds a profile by its identifier. This method is a shortcut to
	@@ -68,7 +68,7 @@ class RssFeed < Article		@@ -68,7 +68,7 @@ class RssFeed < Article
68	if (self.include == 'parent_and_children') && self.parent	68	if (self.include == 'parent_and_children') && self.parent
69	self.parent.map_traversal	69	self.parent.map_traversal
70	else	70	else
71	- profile.recent_documents(self.limit)	71	+ profile.last_articles(self.limit)
72	end	72	end
73	end	73	end
74	def data	74	def data