Enforce restrictions on issue visibility properly

diff --git a/app/controllers/issues_controller.rb b/app/controllers/issues_controller.rb
index 61f466f626a0ef94e27fc908e0b670d0f6aaac82..d136e7230a4b7baf3ccd6eebfda383843598fdc2 100644 (file)
--- a/app/controllers/issues_controller.rb
+++ b/app/controllers/issues_controller.rb
@@ -80,6 +80,8 @@ class IssuesController < ApplicationController
   private
 
   def find_issue
-    @issue = Issue.find(params[:id])
+    @issue = Issue.visible_to(current_user).find(params[:id])
+  rescue ActiveRecord::RecordNotFound
+    head :not_found
   end
 end

diff --git a/test/controllers/issues_controller_test.rb b/test/controllers/issues_controller_test.rb
index af0a86028b111dfb3a84ee6c59302be666c17590..d16f664554117818c96539ebdee7a02ba2c75c29 100644 (file)
--- a/test/controllers/issues_controller_test.rb
+++ b/test/controllers/issues_controller_test.rb
@@ -24,9 +24,9 @@ class IssuesControllerTest < ActionController::TestCase
     assert_response :success
   end
 
-  def test_show
+  def test_show_moderator
     target_user = create(:user)
-    issue = create(:issue, :reportable => target_user, :reported_user => target_user)
+    issue = create(:issue, :reportable => target_user, :reported_user => target_user, :assigned_role => "moderator")
 
     # Access issue without login
     get :show, :params => { :id => issue.id }
@@ -42,17 +42,43 @@ class IssuesControllerTest < ActionController::TestCase
     # Access issue as administrator
     session[:user] = create(:administrator_user).id
     get :show, :params => { :id => issue.id }
+    assert_response :not_found
+
+    # Access issue as moderator
+    session[:user] = create(:moderator_user).id
+    get :show, :params => { :id => issue.id }
     assert_response :success
+  end
+
+  def test_show_administrator
+    target_user = create(:user)
+    issue = create(:issue, :reportable => target_user, :reported_user => target_user, :assigned_role => "administrator")
+
+    # Access issue without login
+    get :show, :params => { :id => issue.id }
+    assert_response :redirect
+    assert_redirected_to login_path(:referer => issue_path(issue))
+
+    # Access issue as normal user
+    session[:user] = create(:user).id
+    get :show, :params => { :id => issue.id }
+    assert_response :redirect
+    assert_redirected_to :controller => :errors, :action => :forbidden
 
     # Access issue as moderator
     session[:user] = create(:moderator_user).id
     get :show, :params => { :id => issue.id }
+    assert_response :not_found
+
+    # Access issue as administrator
+    session[:user] = create(:administrator_user).id
+    get :show, :params => { :id => issue.id }
     assert_response :success
   end
 
-  def test_resolve
+  def test_resolve_moderator
     target_user = create(:user)
-    issue = create(:issue, :reportable => target_user, :reported_user => target_user)
+    issue = create(:issue, :reportable => target_user, :reported_user => target_user, :assigned_role => "moderator")
 
     # Resolve issue without login
     get :resolve, :params => { :id => issue.id }
@@ -68,21 +94,47 @@ class IssuesControllerTest < ActionController::TestCase
     # Resolve issue as administrator
     session[:user] = create(:administrator_user).id
     get :resolve, :params => { :id => issue.id }
+    assert_response :not_found
+    assert_equal false, issue.reload.resolved?
+
+    # Resolve issue as moderator
+    session[:user] = create(:moderator_user).id
+    get :resolve, :params => { :id => issue.id }
     assert_response :redirect
     assert_equal true, issue.reload.resolved?
+  end
 
-    issue.reopen!
+  def test_resolve_administrator
+    target_user = create(:user)
+    issue = create(:issue, :reportable => target_user, :reported_user => target_user, :assigned_role => "administrator")
+
+    # Resolve issue without login
+    get :resolve, :params => { :id => issue.id }
+    assert_response :redirect
+    assert_redirected_to login_path(:referer => resolve_issue_path(issue))
+
+    # Resolve issue as normal user
+    session[:user] = create(:user).id
+    get :resolve, :params => { :id => issue.id }
+    assert_response :redirect
+    assert_redirected_to :controller => :errors, :action => :forbidden
 
     # Resolve issue as moderator
     session[:user] = create(:moderator_user).id
     get :resolve, :params => { :id => issue.id }
+    assert_response :not_found
+    assert_equal false, issue.reload.resolved?
+
+    # Resolve issue as administrator
+    session[:user] = create(:administrator_user).id
+    get :resolve, :params => { :id => issue.id }
     assert_response :redirect
     assert_equal true, issue.reload.resolved?
   end
 
-  def test_ignore
+  def test_ignore_moderator
     target_user = create(:user)
-    issue = create(:issue, :reportable => target_user, :reported_user => target_user)
+    issue = create(:issue, :reportable => target_user, :reported_user => target_user, :assigned_role => "moderator")
 
     # Ignore issue without login
     get :ignore, :params => { :id => issue.id }
@@ -98,21 +150,47 @@ class IssuesControllerTest < ActionController::TestCase
     # Ignore issue as administrator
     session[:user] = create(:administrator_user).id
     get :ignore, :params => { :id => issue.id }
+    assert_response :not_found
+    assert_equal false, issue.reload.ignored?
+
+    # Ignore issue as moderator
+    session[:user] = create(:moderator_user).id
+    get :ignore, :params => { :id => issue.id }
     assert_response :redirect
     assert_equal true, issue.reload.ignored?
+  end
+
+  def test_ignore_administrator
+    target_user = create(:user)
+    issue = create(:issue, :reportable => target_user, :reported_user => target_user, :assigned_role => "administrator")
+
+    # Ignore issue without login
+    get :ignore, :params => { :id => issue.id }
+    assert_response :redirect
+    assert_redirected_to login_path(:referer => ignore_issue_path(issue))
 
-    issue.reopen!
+    # Ignore issue as normal user
+    session[:user] = create(:user).id
+    get :ignore, :params => { :id => issue.id }
+    assert_response :redirect
+    assert_redirected_to :controller => :errors, :action => :forbidden
 
     # Ignore issue as moderator
     session[:user] = create(:moderator_user).id
     get :ignore, :params => { :id => issue.id }
+    assert_response :not_found
+    assert_equal false, issue.reload.ignored?
+
+    # Ignore issue as administrator
+    session[:user] = create(:administrator_user).id
+    get :ignore, :params => { :id => issue.id }
     assert_response :redirect
     assert_equal true, issue.reload.ignored?
   end
 
-  def test_reopen
+  def test_reopen_moderator
     target_user = create(:user)
-    issue = create(:issue, :reportable => target_user, :reported_user => target_user)
+    issue = create(:issue, :reportable => target_user, :reported_user => target_user, :assigned_role => "moderator")
 
     issue.resolve!
 
@@ -130,14 +208,42 @@ class IssuesControllerTest < ActionController::TestCase
     # Reopen issue as administrator
     session[:user] = create(:administrator_user).id
     get :reopen, :params => { :id => issue.id }
+    assert_response :not_found
+    assert_equal false, issue.reload.open?
+
+    # Reopen issue as moderator
+    session[:user] = create(:moderator_user).id
+    get :reopen, :params => { :id => issue.id }
     assert_response :redirect
     assert_equal true, issue.reload.open?
+  end
+
+  def test_reopen_administrator
+    target_user = create(:user)
+    issue = create(:issue, :reportable => target_user, :reported_user => target_user, :assigned_role => "administrator")
 
     issue.resolve!
 
+    # Reopen issue without login
+    get :reopen, :params => { :id => issue.id }
+    assert_response :redirect
+    assert_redirected_to login_path(:referer => reopen_issue_path(issue))
+
+    # Reopen issue as normal user
+    session[:user] = create(:user).id
+    get :reopen, :params => { :id => issue.id }
+    assert_response :redirect
+    assert_redirected_to :controller => :errors, :action => :forbidden
+
     # Reopen issue as moderator
     session[:user] = create(:moderator_user).id
     get :reopen, :params => { :id => issue.id }
+    assert_response :not_found
+    assert_equal false, issue.reload.open?
+
+    # Reopen issue as administrator
+    session[:user] = create(:administrator_user).id
+    get :reopen, :params => { :id => issue.id }
     assert_response :redirect
     assert_equal true, issue.reload.open?
   end

diff --git a/test/system/issues_test.rb b/test/system/issues_test.rb
index 08b1acb3460d1f7a7135d4bb0980771a2b887a15..ebf1d272a5015a481679a680acd959c9e398e093 100644 (file)
--- a/test/system/issues_test.rb
+++ b/test/system/issues_test.rb
@@ -72,7 +72,7 @@ class IssuesTest < ApplicationSystemTestCase
   end
 
   def test_commenting
-    issue = create(:issue)
+    issue = create(:issue, :assigned_role => "moderator")
     sign_in_as(create(:moderator_user))
 
     visit issue_path(issue)