Commit ac0686ccfa3ab8b9d8a1291236c7d4eb21429f79
1 parent
fa9663f8
Exists in
staging
and in
1 other branch
api: restrict access to block endpoint based on block visibility
Showing
3 changed files
with
72 additions
and
3 deletions
Show diff stats
app/models/block.rb
| @@ -76,6 +76,17 @@ class Block < ApplicationRecord | @@ -76,6 +76,17 @@ class Block < ApplicationRecord | ||
| 76 | true | 76 | true |
| 77 | end | 77 | end |
| 78 | 78 | ||
| 79 | + def visible_to_user?(user) | ||
| 80 | + visible = self.display_to_user?(user) | ||
| 81 | + if self.owner.kind_of?(Profile) | ||
| 82 | + visible &= self.owner.display_info_to?(user) | ||
| 83 | + visible &= (self.visible? || user && user.has_permission?(:edit_profile_design, self.owner)) | ||
| 84 | + elsif self.owner.kind_of?(Environment) | ||
| 85 | + visible &= (self.visible? || user && user.has_permission?(:edit_environment_design, self.owner)) | ||
| 86 | + end | ||
| 87 | + visible | ||
| 88 | + end | ||
| 89 | + | ||
| 79 | def display_to_user?(user) | 90 | def display_to_user?(user) |
| 80 | display_user == 'all' || (user.nil? && display_user == 'not_logged') || (user && display_user == 'logged') || (user && display_user == 'followers' && user.follows?(owner)) | 91 | display_user == 'all' || (user.nil? && display_user == 'not_logged') || (user && display_user == 'logged') || (user && display_user == 'followers' && user.follows?(owner)) |
| 81 | end | 92 | end |
lib/noosfero/api/v1/blocks.rb
| @@ -6,9 +6,7 @@ module Noosfero | @@ -6,9 +6,7 @@ module Noosfero | ||
| 6 | resource :blocks do | 6 | resource :blocks do |
| 7 | get ':id' do | 7 | get ':id' do |
| 8 | block = Block.find(params["id"]) | 8 | block = Block.find(params["id"]) |
| 9 | - if block.owner.kind_of?(Profile) | ||
| 10 | - return forbidden! unless block.owner.display_info_to?(current_person) | ||
| 11 | - end | 9 | + return forbidden! unless block.visible_to_user?(current_person) |
| 12 | present block, :with => Entities::Block, display_api_content: true | 10 | present block, :with => Entities::Block, display_api_content: true |
| 13 | end | 11 | end |
| 14 | end | 12 | end |
test/unit/block_test.rb
| @@ -398,4 +398,64 @@ class BlockTest < ActiveSupport::TestCase | @@ -398,4 +398,64 @@ class BlockTest < ActiveSupport::TestCase | ||
| 398 | assert block.get_limit.is_a?(Fixnum) | 398 | assert block.get_limit.is_a?(Fixnum) |
| 399 | end | 399 | end |
| 400 | 400 | ||
| 401 | + should 'return true at visible_to_user? when block is visible' do | ||
| 402 | + block = Block.new | ||
| 403 | + person = create_user('person_one').person | ||
| 404 | + assert block.visible_to_user?(person) | ||
| 405 | + end | ||
| 406 | + | ||
| 407 | + should 'return false at visible_to_user? when block is not visible and user is nil' do | ||
| 408 | + block = Block.new | ||
| 409 | + person = create_user('person_one').person | ||
| 410 | + block.stubs(:owner).returns(person) | ||
| 411 | + block.expects(:visible?).returns(false) | ||
| 412 | + assert !block.visible_to_user?(nil) | ||
| 413 | + end | ||
| 414 | + | ||
| 415 | + should 'return false at visible_to_user? when block is not visible and user does not has permission' do | ||
| 416 | + block = Block.new | ||
| 417 | + person = create_user('person_one').person | ||
| 418 | + community = fast_create(Community) | ||
| 419 | + block.stubs(:owner).returns(community) | ||
| 420 | + block.expects(:visible?).returns(false) | ||
| 421 | + assert !block.visible_to_user?(person) | ||
| 422 | + end | ||
| 423 | + | ||
| 424 | + should 'return true at visible_to_user? when block is not visible and user has permission' do | ||
| 425 | + block = Block.new | ||
| 426 | + person = create_user('person_one').person | ||
| 427 | + community = fast_create(Community) | ||
| 428 | + give_permission(person, 'edit_profile_design', community) | ||
| 429 | + block.stubs(:owner).returns(community) | ||
| 430 | + block.expects(:visible?).returns(false) | ||
| 431 | + assert block.visible_to_user?(person) | ||
| 432 | + end | ||
| 433 | + | ||
| 434 | + should 'return false at visible_to_user? when block is not visible and user does not has permission in environment' do | ||
| 435 | + block = Block.new | ||
| 436 | + environment = Environment.default | ||
| 437 | + person = create_user('person_one').person | ||
| 438 | + block.stubs(:owner).returns(environment) | ||
| 439 | + block.expects(:visible?).returns(false) | ||
| 440 | + assert !block.visible_to_user?(person) | ||
| 441 | + end | ||
| 442 | + | ||
| 443 | + should 'return true at visible_to_user? when block is not visible and user has permission in environment' do | ||
| 444 | + block = Block.new | ||
| 445 | + environment = Environment.default | ||
| 446 | + person = create_user('person_one').person | ||
| 447 | + give_permission(person, 'edit_environment_design', environment) | ||
| 448 | + block.stubs(:owner).returns(environment) | ||
| 449 | + block.expects(:visible?).returns(false) | ||
| 450 | + assert block.visible_to_user?(person) | ||
| 451 | + end | ||
| 452 | + | ||
| 453 | + should 'return false at visible_to_user? when block is not visible to user' do | ||
| 454 | + block = Block.new | ||
| 455 | + person = create_user('person_one').person | ||
| 456 | + block.stubs(:owner).returns(person) | ||
| 457 | + block.expects(:visible?).returns(true) | ||
| 458 | + block.expects(:display_to_user?).returns(false) | ||
| 459 | + assert !block.visible_to_user?(nil) | ||
| 460 | + end | ||
| 401 | end | 461 | end |