FIX: Validate post's polls as acting user (#16638)

It used to validate the post from the perspective of the user who
created the post. That did not work well when an admin attempted to
add a poll to a post created by a user who cannot create posts because
it said the user cannot create polls.

The problem was that it used post.user for the validation process
instead of post.acting_user.
This commit is contained in:
Bianca Nenciu
2022-05-05 09:54:10 +03:00
committed by GitHub
parent b35cf7cc0c
commit 62cbb766cd
2 changed files with 25 additions and 1 deletions

View File

@ -443,4 +443,28 @@ describe PostsController do
expect(Poll.exists?(post_id: json["id"])).to eq(true)
end
end
describe "staff editing posts of users with insufficient trust level" do
before do
SiteSetting.poll_minimum_trust_level_to_create = 2
end
it "validates the post" do
log_in_user(Fabricate(:user, trust_level: 1))
post :create, params: { title: title, raw: title }, format: :json
expect(response.status).to eq(200)
post_id = response.parsed_body["id"]
log_in_user(Fabricate(:admin))
put :update, params: {
id: post_id, post: { raw: "#{title}\n[poll]\n- A\n- B\n- C\n[/poll]" }
}, format: :json
expect(response.status).to eq(200)
expect(response.parsed_body["post"]["polls"][0]["options"][2]["html"]).to eq("C")
end
end
end