github-mirror/discourse
2
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2025-05-31 22:35:03 +08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

SECURITY: Hide notifications for inaccessible topics (#19208)

Browse Source 
Filter notifications the user cannot see anymore
via guardian.can_see_topic_ids
This commit is contained in:
Martin Brennan
2022-11-28 10:41:57 +10:00
committed by GitHub
parent 6335b2c7ba
commit c6ee28ec75
2 changed files with 53 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

44
spec/requests/notifications_controller_spec.rb
View File

@ -339,6 +339,50 @@ RSpec.describe NotificationsController do
expect(response.status).to eq(404)
end
end
context "with notifications for inaccessible topics" do
fab!(:sender) { Fabricate.build(:topic_allowed_user, user: Fabricate(:coding_horror)) }
fab!(:allowed_user) { Fabricate.build(:topic_allowed_user, user: user) }
fab!(:another_allowed_user) { Fabricate.build(:topic_allowed_user, user: Fabricate(:user)) }
fab!(:allowed_pm) { Fabricate(:private_message_topic, topic_allowed_users: [sender, allowed_user, another_allowed_user]) }
fab!(:forbidden_pm) { Fabricate(:private_message_topic, topic_allowed_users: [sender, another_allowed_user]) }
fab!(:allowed_pm_notification) { Fabricate(:private_message_notification, user: user, topic: allowed_pm) }
fab!(:forbidden_pm_notification) { Fabricate(:private_message_notification, user: user, topic: forbidden_pm) }
def expect_correct_notifications(response)
notification_ids = response.parsed_body["notifications"].map { |n| n["id"] }
expect(notification_ids).to include(allowed_pm_notification.id)
expect(notification_ids).to_not include(forbidden_pm_notification.id)
end
context "with 'recent' filter" do
it "doesn't include notifications from topics the user isn't allowed to see" do
SiteSetting.enable_experimental_sidebar_hamburger = true
get "/notifications.json", params: { recent: true }
expect(response.status).to eq(200)
expect_correct_notifications(response)
SiteSetting.enable_experimental_sidebar_hamburger = false
get "/notifications.json", params: { recent: true }
expect(response.status).to eq(200)
expect_correct_notifications(response)
end
end
context "without 'recent' filter" do
it "doesn't include notifications from topics the user isn't allowed to see" do
SiteSetting.enable_experimental_sidebar_hamburger = true
get "/notifications.json"
expect(response.status).to eq(200)
expect_correct_notifications(response)
SiteSetting.enable_experimental_sidebar_hamburger = false
get "/notifications.json"
expect(response.status).to eq(200)
expect_correct_notifications(response)
end
end
end
end
it 'should succeed' do