FIX: TL4 users can see their deleted posts (#13364)

This commit is contained in:
Bianca Nenciu 2021-06-21 19:10:02 +03:00 committed by GitHub
parent e50b7e9111
commit e70e8d8d8f
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 14 additions and 3 deletions

View File

@ -233,9 +233,9 @@ module PostGuardian
return true if is_admin?
return false unless can_see_topic?(post.topic)
return false unless post.user == @user || Topic.visible_post_types(@user).include?(post.post_type)
return false if !(is_moderator? || is_category_group_moderator?(post.topic.category)) && post.deleted_at.present?
true
return true if is_moderator? || is_category_group_moderator?(post.topic.category)
return true if post.deleted_at.blank? || (post.deleted_by_id == @user.id && @user.has_trust_level?(TrustLevel[4]))
false
end
def can_view_edit_history?(post)

View File

@ -902,6 +902,17 @@ describe Guardian do
expect(Guardian.new(user_gm).can_see?(post)).to be_truthy
end
it 'TL4 users can see their deleted posts' do
user = Fabricate(:user, trust_level: 4)
user2 = Fabricate(:user, trust_level: 4)
post = Fabricate(:post, user: user, topic: Fabricate(:post).topic)
expect(Guardian.new(user).can_see?(post)).to eq(true)
PostDestroyer.new(user, post).destroy
expect(Guardian.new(user).can_see?(post)).to eq(true)
expect(Guardian.new(user2).can_see?(post)).to eq(false)
end
it 'respects whispers' do
regular_post = post
whisper_post = Fabricate.build(:post, post_type: Post.types[:whisper])