Download as
Browse Code »

Commit 0b6af5138a22d8dc990915331cd1802009625a3e

Authored by AntonioTerceiro
1 parent ad2520f9
Exists in master and in 28 other branches 1.2+SPB2, 2_split_by_role, add_fields_in_api, api_fixies, api_pagination, api_private_token, api_tasks, article_hit_count, blog_page_bug, checkbox_to_user_can_edit_page, communities_ratings, communities_ratings_moderation, community_ratings_rebase, fix_cloned_article_parent, fix_gallery_image_url, fix_javascript_categories, fix_optional_fields, fix_suggest_article, fix_user_email_validation, highlight_block_fix, notification_plugin, notification_plugin_rebase, script_to_update, split_by_role, stable, temp_ratings, tests, tests_fixies

ActionItem295: adding access control checks to Article 


git-svn-id: https://svn.colivre.coop.br/svn/noosfero/trunk@1824 3f533792-8f58-4932-b0fe-aaf55b0a4547
Showing 2 changed files with 68 additions and 0 deletions   Show diff stats
app/models/article.rb
  Diff comments   View file @0b6af51
... ... @@ -120,6 +120,18 @@ class Article < ActiveRecord::Base
120 120 self.find(:all, :order => 'articles.name', :conditions => [ 'articles.name like (?) or articles.name like (?)', initial + '%', initial.upcase + '%'])
121 121 end
122 122  
  123 + def display_to?(user)
  124 + if self.profile.public_content
  125 + true
  126 + else
  127 + if user.nil?
  128 + false
  129 + else
  130 + (user == self.profile) || user.memberships.include?(self.profile)
  131 + end
  132 + end
  133 + end
  134 +
123 135 private
124 136  
125 137 def sanitize_tag_list
... ...
test/unit/article_test.rb
  Diff comments   View file @0b6af51
... ... @@ -233,4 +233,60 @@ class ArticleTest < Test::Unit::TestCase
233 233 assert !Article.new.folder?, 'should identify itself as non-folder'
234 234 end
235 235  
  236 + should 'always display if public content' do
  237 + person = create_user('testuser').person
  238 + assert_equal true, person.home_page.display_to?(nil)
  239 + end
  240 +
  241 + should 'display to owner' do
  242 + # a person with private contents ...
  243 + person = create_user('testuser').person
  244 + person.update_attributes!(:public_content => false)
  245 +
  246 + # ... can see his own articles
  247 + a = person.articles.create!(:name => 'test article')
  248 + assert_equal true, a.display_to?(person)
  249 + end
  250 +
  251 + should 'not display to other unauthenticated user if private' do
  252 + # a person with private contents ...
  253 + person = create_user('testuser').person
  254 + person.update_attributes!(:public_content => false)
  255 +
  256 + # ... has an article ...
  257 + a1 = person.articles.create!(:name => 'test article')
  258 +
  259 + # ... which anonymous users cannot view
  260 + assert_equal false, a1.display_to?(nil)
  261 + end
  262 +
  263 + should 'not display to another user if private' do
  264 + # a person with private contents ...
  265 + person = create_user('testuser').person
  266 + person.update_attributes!(:public_content => false)
  267 +
  268 + # ... has an article ...
  269 + a1 = person.articles.create!(:name => 'test article')
  270 +
  271 + # ... which another user cannot see
  272 + another_user = create_user('another_user').person
  273 + assert_equal false, a1.display_to?(another_user)
  274 + end
  275 +
  276 + should 'display for members of profile' do
  277 + # a community with private content ...
  278 + community = Community.create!(:name => 'test community')
  279 + community.update_attributes!(:public_content => false)
  280 +
  281 + # ... has an article ...
  282 + a1 = community.articles.create!(:name => 'test article')
  283 +
  284 + # ... and its members ...
  285 + member = create_user('testuser').person
  286 + community.add_member(member)
  287 +
  288 + # ... can view that article
  289 + assert_equal true, a1.display_to?(member)
  290 + end
  291 +
236 292 end
... ...