github-mirror/discourse
2
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2025-05-25 00:32:52 +08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

FIX: only staff can banner topics

Browse Source
This commit is contained in:
Arpit Jalan
2019-04-02 12:38:15 +05:30
parent d85240335b
commit d68d29f37a
4 changed files with 40 additions and 34 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
app/assets/javascripts/discourse/templates/modal/feature-topic.hbs
View File

@ -110,6 +110,7 @@
</div> </div>
</div> </div>
{{/if}} {{/if}}
{{#if currentUser.staff}}
<hr> <hr>
<div class="feature-section"> <div class="feature-section">
<div class="desc"> <div class="desc">
@ -141,6 +142,7 @@
</p> </p>
</div> </div>
</div> </div>
{{/if}}
{{/d-modal-body}} {{/d-modal-body}}
<div class="modal-footer"> <div class="modal-footer">
{{d-modal-cancel close=(route-action "closeModal")}} {{d-modal-cancel close=(route-action "closeModal")}}

4
app/controllers/topics_controller.rb
View File

@ -408,7 +408,7 @@ class TopicsController < ApplicationController
def make_banner def make_banner
topic = Topic.find_by(id: params[:topic_id].to_i) topic = Topic.find_by(id: params[:topic_id].to_i)
guardian.ensure_can_moderate!(topic) guardian.ensure_can_banner_topic!(topic)
topic.make_banner!(current_user) topic.make_banner!(current_user)
@ -417,7 +417,7 @@ class TopicsController < ApplicationController
def remove_banner def remove_banner
topic = Topic.find_by(id: params[:topic_id].to_i) topic = Topic.find_by(id: params[:topic_id].to_i)
guardian.ensure_can_moderate!(topic) guardian.ensure_can_banner_topic!(topic)
topic.remove_banner!(current_user) topic.remove_banner!(current_user)

4
lib/guardian/topic_guardian.rb
View File

@ -154,4 +154,8 @@ module TopicGuardian
def can_update_bumped_at? def can_update_bumped_at?
is_staff? || @user.has_trust_level?(TrustLevel[4]) is_staff? || @user.has_trust_level?(TrustLevel[4])
end end
def can_banner_topic?(topic)
authenticated? && !topic.private_message? && is_staff?
end
end end

8
spec/requests/topics_controller_spec.rb
View File

@ -1907,8 +1907,8 @@ RSpec.describe TopicsController do
describe '#make_banner' do describe '#make_banner' do
it 'needs you to be a staff member' do it 'needs you to be a staff member' do
sign_in(Fabricate(:user)) topic = Fabricate(:topic, user: sign_in(Fabricate(:trust_level_4)))
put "/t/99/make-banner.json" put "/t/#{topic.id}/make-banner.json"
expect(response).to be_forbidden expect(response).to be_forbidden
end end
@ -1926,8 +1926,8 @@ RSpec.describe TopicsController do
describe '#remove_banner' do describe '#remove_banner' do
it 'needs you to be a staff member' do it 'needs you to be a staff member' do
sign_in(Fabricate(:user)) topic = Fabricate(:topic, user: sign_in(Fabricate(:trust_level_4)), archetype: Archetype.banner)
put "/t/99/remove-banner.json" put "/t/#{topic.id}/remove-banner.json"
expect(response).to be_forbidden expect(response).to be_forbidden
end end