From 0b6f316d85fdebb2cd80b650f05ad9458b6b68fc Mon Sep 17 00:00:00 2001 From: Victor Costa Date: Wed, 4 May 2016 15:54:50 -0300 Subject: [PATCH] api: list only published children when get an article --- lib/noosfero/api/entities.rb | 2 +- test/api/articles_test.rb | 9 +++++++++ 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/lib/noosfero/api/entities.rb b/lib/noosfero/api/entities.rb index 341e593..a31c7c0 100644 --- a/lib/noosfero/api/entities.rb +++ b/lib/noosfero/api/entities.rb @@ -203,7 +203,7 @@ module Noosfero root 'articles', 'article' expose :parent, :using => ArticleBase expose :children, :using => ArticleBase do |article, options| - article.children.limit(Noosfero::API::V1::Articles::MAX_PER_PAGE) + article.children.published.limit(Noosfero::API::V1::Articles::MAX_PER_PAGE) end end diff --git a/test/api/articles_test.rb b/test/api/articles_test.rb index 80fd33a..a7947e6 100644 --- a/test/api/articles_test.rb +++ b/test/api/articles_test.rb @@ -735,4 +735,13 @@ class ArticlesTest < ActiveSupport::TestCase assert_not_includes json["article"].keys, "comments" end + should 'not list private child when get the parent article' do + person = fast_create(Person, :environment_id => environment.id) + article = fast_create(Article, :profile_id => person.id, :name => "Some thing") + child = fast_create(Article, :parent_id => article.id, :profile_id => person.id, :name => "Some thing", :published => false) + get "/api/v1/articles/#{article.id}?#{params.to_query}" + json = JSON.parse(last_response.body) + assert_not_includes json['article']['children'].map {|a| a['id']}, child.id + end + end -- libgit2 0.21.2