diff --git a/app/api/v1/comments.rb b/app/api/v1/comments.rb index 68ad20c..e47cdaa 100644 --- a/app/api/v1/comments.rb +++ b/app/api/v1/comments.rb @@ -34,6 +34,7 @@ module Api post ":id/comments" do authenticate! article = find_article(environment.articles, params[:id]) + return forbidden! unless article.accept_comments? options = params.select { |key,v| !['id','private_token'].include?(key) }.merge(:author => current_person, :source => article) begin comment = Comment.create!(options) diff --git a/test/api/comments_test.rb b/test/api/comments_test.rb index 601c299..e5ca9fe 100644 --- a/test/api/comments_test.rb +++ b/test/api/comments_test.rb @@ -70,6 +70,16 @@ class CommentsTest < ActiveSupport::TestCase assert_equal body, json['comment']['body'] end + should 'not create comment when an article does not accept comments' do + login_api + article = fast_create(Article, :profile_id => @local_person.id, :name => "Some thing", accept_comments: false) + body = 'My comment' + params.merge!({:body => body}) + post "/api/v1/articles/#{article.id}/comments?#{params.to_query}" + json = JSON.parse(last_response.body) + assert_equal 403, last_response.status + end + should 'logged user not comment an archived article' do login_api article = fast_create(Article, :profile_id => user.person.id, :name => "Some thing", :archived => true) -- libgit2 0.21.2