webapp/bookstack
1
0
Fork 0
mirror of https://github.com/BookStackApp/BookStack.git synced 2025-07-28 17:02:04 +03:00
Code Activity

Notifications: Fixed send content permission checking

Browse Source 
Added test and changed logic to properly check the view permissions for
the notification receiver before sending.
Required change to permissions applicator to allow the user to be
manually determined, and a service provider update to provide the class
as a singleton without a specific user, so it checks the current logged
in user on demand.
This commit is contained in:
Dan Brown
2023-08-17 17:57:31 +01:00
parent ee9e342b58
commit 38829f8a38
5 changed files with 31 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
tests/Activity/WatchTest.php
View File

@ -312,4 +312,21 @@ class WatchTest extends TestCase
&& str_contains($mailContent, 'Created By: ' . $admin->name);
});
}
public function test_notifications_not_sent_if_lacking_view_permission_for_related_item()
{
$notifications = Notification::fake();
$editor = $this->users->editor();
$page = $this->entities->page();
$watches = new UserEntityWatchOptions($editor, $page);
$watches->updateWatchLevel('comments');
$this->permissions->disableEntityInheritedPermissions($page);
$this->asAdmin()->post("/comment/{$page->id}", [
'text' => 'My new comment response',
])->assertOk();
$notifications->assertNothingSentTo($editor);
}
}