diff --git a/plugins/poll/lib/polls_updater.rb b/plugins/poll/lib/polls_updater.rb index 72913c67ab0..33bc213ce5c 100644 --- a/plugins/poll/lib/polls_updater.rb +++ b/plugins/poll/lib/polls_updater.rb @@ -18,8 +18,10 @@ module DiscoursePoll poll_edit_window_mins = SiteSetting.poll_edit_window_mins if post.created_at < poll_edit_window_mins.minutes.ago && has_votes - # cannot add/remove/rename polls - if polls.keys.sort != previous_polls.keys.sort + is_staff = User.staff.where(id: post.last_editor_id).exists? + + # non staff users cannot add/remove/rename polls + if !is_staff && (polls.keys.sort != previous_polls.keys.sort) post.errors.add(:base, I18n.t( "poll.edit_window_expired.cannot_change_polls", minutes: poll_edit_window_mins )) @@ -28,10 +30,10 @@ module DiscoursePoll end # deal with option changes - if User.staff.where(id: post.last_editor_id).exists? - # staff can only edit options + if is_staff + # staff can edit options polls.each_key do |poll_name| - if polls[poll_name]["options"].size != previous_polls[poll_name]["options"].size && previous_polls[poll_name]["voters"].to_i > 0 + if polls.dig(poll_name, "options")&.size != previous_polls.dig(poll_name, "options")&.size && previous_polls.dig(poll_name, "voters").to_i > 0 post.errors.add(:base, I18n.t( "poll.edit_window_expired.staff_cannot_add_or_remove_options", minutes: poll_edit_window_mins diff --git a/plugins/poll/spec/lib/polls_updater_spec.rb b/plugins/poll/spec/lib/polls_updater_spec.rb index e8a6a0e4681..169063c1576 100644 --- a/plugins/poll/spec/lib/polls_updater_spec.rb +++ b/plugins/poll/spec/lib/polls_updater_spec.rb @@ -297,6 +297,21 @@ describe DiscoursePoll::PollsUpdater do context "staff" do let(:another_user) { Fabricate(:user) } + before do + another_post.update_attributes!(last_editor_id: User.staff.first.id) + end + + it "should allow staff to add polls" do + message = MessageBus.track_publish do + described_class.update(another_post, two_polls) + end.first + + expect(another_post.errors.full_messages).to eq([]) + + expect(message.data[:post_id]).to eq(another_post.id) + expect(message.data[:polls]).to eq(two_polls) + end + it "should not allow staff to add options if votes have been casted" do another_post.update_attributes!(last_editor_id: User.staff.first.id)