Download as
Browse Code »

Commit 2dbb8586db43409cc630c1ada1efcbfea5b5a7dd

Authored by Tallys Martins
Committed by Gabriela Navarro
1 parent 320bcfbb
Exists in staging and in 42 other branches all_pending_tasks_api, api-articles-period, api_roles, caching-rails4, captcha_serpro_plugin, comments_permissions, content-manager-hostspot, elasticsearch, elasticsearch_api, elasticsearch_categories, elasticsearch_filter, elasticsearch_sort, elasticsearch_to_merge, elasticsearch_view, environment-exposes-api, export-comment-api, export-comment-paragraph, export_data, external_followers, federation-webfinger, federation_followers, federation_followers_backend, federation_oauth_provider, federation_webfinger, fix_event_date_issue, fix_notification_email, fix_string_downcase_and_upcase, follower_permition, json_cookie_serializer, login-captcha, master, master_profile_followers, oauth_external_login, oauth_login, private-scraps, private-scraps-rebase, production, production-vendorized, profile_api_improvements, tasks_keep_filter_params, user_mention, webfinger_server

Move privace methods of profile_controller to public_controller 

- Create tests for private and invisible communities using the privace methods
 - Executing filters for events and contact pages in private profiles

Signed-off-by: Arthur Del Esposte <arthurmde@gmail.com>
Signed-off-by: Gabriela Navarro <navarro1703@gmail.com>
Signed-off-by: Luciano Prestes <lucianopcbr@gmail.com>
Signed-off-by: Tallys Martins <tallysmartins@yahoo.com.br>
Showing 6 changed files with 81 additions and 18 deletions   Show diff stats
app/controllers/public/contact_controller.rb
  Diff comments   View file @2dbb858
1 1 class ContactController < PublicController
2 2  
3 3 needs_profile
  4 + before_filter :allow_access_to_page
4 5  
5 6 def new
6 7 @contact = build_contact
... ...
app/controllers/public/events_controller.rb
  Diff comments   View file @2dbb858
1 1 class EventsController < PublicController
2 2  
3 3 needs_profile
  4 + before_filter :allow_access_to_page
4 5  
5 6 def events
6 7 @events = []
... ...
app/controllers/public/profile_controller.rb
  Diff comments   View file @2dbb858
... ... @@ -16,13 +16,7 @@ class ProfileController &lt; PublicController
16 16 @activities = @profile.activities.paginate(:per_page => 15, :page => params[:page])
17 17 end
18 18 @tags = profile.article_tags
19   - unless profile.display_info_to?(user)
20   - if profile.visible?
21   - private_profile
22   - else
23   - invisible_profile
24   - end
25   - end
  19 + allow_access_to_page
26 20 end
27 21  
28 22 def tags
... ... @@ -396,17 +390,6 @@ class ProfileController &lt; PublicController
396 390 end
397 391 end
398 392  
399   - def private_profile
400   - private_profile_partial_parameters
401   - render :action => 'index', :status => 403
402   - end
403   -
404   - def invisible_profile
405   - unless profile.is_template?
406   - render_access_denied(_("This profile is inaccessible. You don't have the permission to view the content here."), _("Oops ... you cannot go ahead here"))
407   - end
408   - end
409   -
410 393 def per_page
411 394 Noosfero::Constants::PROFILE_PER_PAGE
412 395 end
... ...
app/controllers/public_controller.rb
  Diff comments   View file @2dbb858
1 1 class PublicController < ApplicationController
  2 + protected
  3 +
  4 + def allow_access_to_page
  5 + unless profile.display_info_to?(user)
  6 + if profile.visible?
  7 + private_profile
  8 + else
  9 + invisible_profile
  10 + end
  11 + end
  12 + end
  13 +
  14 + def private_profile
  15 + private_profile_partial_parameters
  16 + render :template => 'shared/access_denied.html.erb', :status => 403
  17 + end
  18 +
  19 + def invisible_profile
  20 + unless profile.is_template?
  21 + render_access_denied(_("This profile is inaccessible. You don't have the permission to view the content here."), _("Oops ... you cannot go ahead here"))
  22 + end
  23 + end
2 24 end
... ...
test/functional/contact_controller_test.rb
  Diff comments   View file @2dbb858
... ... @@ -125,4 +125,31 @@ class ContactControllerTest &lt; ActionController::TestCase
125 125 assert_equal 'Bahia', assigns(:contact).state
126 126 end
127 127  
  128 + should 'not show send e-mail page to non members of private community' do
  129 + community = fast_create(Community, :identifier => 'private-community', :name => 'Private Community', :public_profile => false)
  130 +
  131 + post :new, :profile => community.identifier
  132 +
  133 + assert_response :forbidden
  134 + assert_template :access_denied
  135 + end
  136 +
  137 + should 'not show send e-mail page to non members of invisible community' do
  138 + community = fast_create(Community, :identifier => 'invisible-community', :name => 'Private Community', :visible => false)
  139 +
  140 + post :new, :profile => community.identifier
  141 +
  142 + assert_response :forbidden
  143 + assert_template :access_denied
  144 + end
  145 +
  146 + should 'show send e-mail page to members of private community' do
  147 + community = fast_create(Community, :identifier => 'private-community', :name => 'Private Community', :public_profile => false)
  148 + community.add_member(@profile)
  149 +
  150 + post :new, :profile => community.identifier
  151 +
  152 + assert_response :success
  153 + end
  154 +
128 155 end
... ...
test/functional/events_controller_test.rb
  Diff comments   View file @2dbb858
... ... @@ -54,4 +54,33 @@ class EventsControllerTest &lt; ActionController::TestCase
54 54 assert_tag :tag => 'a', :content => /Joao Birthday/
55 55 end
56 56  
  57 + should 'not show events page to non members of private community' do
  58 + community = fast_create(Community, :identifier => 'private-community', :name => 'Private Community', :public_profile => false)
  59 +
  60 + post :events, :profile => community.identifier
  61 +
  62 + assert_response :forbidden
  63 + assert_template :access_denied
  64 + end
  65 +
  66 + should 'not show events page to non members of invisible community' do
  67 + community = fast_create(Community, :identifier => 'invisible-community', :name => 'Private Community', :visible => false)
  68 +
  69 + post :events, :profile => community.identifier
  70 +
  71 + assert_response :forbidden
  72 + assert_template :access_denied
  73 + end
  74 +
  75 + should 'show events page to members of private community' do
  76 + community = fast_create(Community, :identifier => 'private-community', :name => 'Private Community', :public_profile => false)
  77 + community.add_member(@profile)
  78 +
  79 + login_as('testuser')
  80 +
  81 + post :events, :profile => community.identifier
  82 +
  83 + assert_response :success
  84 + end
  85 +
57 86 end
... ...