diff --git a/plugins/poll/lib/post_validator.rb b/plugins/poll/lib/post_validator.rb index 788fe1e24bb..5d21f70a8cd 100644 --- a/plugins/poll/lib/post_validator.rb +++ b/plugins/poll/lib/post_validator.rb @@ -9,7 +9,7 @@ module DiscoursePoll def validate_post min_trust_level = SiteSetting.poll_minimum_trust_level_to_create - if @post&.user&.staff? || @post&.user&.trust_level >= TrustLevel[min_trust_level] || @post&.topic&.pm_with_non_human_user? + if (@post.acting_user && (@post.acting_user.staff? || @post.acting_user.trust_level >= TrustLevel[min_trust_level])) || @post.topic&.pm_with_non_human_user? true else @post.errors.add(:base, I18n.t("poll.insufficient_rights_to_create")) diff --git a/plugins/poll/spec/controllers/posts_controller_spec.rb b/plugins/poll/spec/controllers/posts_controller_spec.rb index ab0df1e6b22..5cc316a9b42 100644 --- a/plugins/poll/spec/controllers/posts_controller_spec.rb +++ b/plugins/poll/spec/controllers/posts_controller_spec.rb @@ -443,4 +443,28 @@ describe PostsController do expect(Poll.exists?(post_id: json["id"])).to eq(true) end end + + describe "staff editing posts of users with insufficient trust level" do + before do + SiteSetting.poll_minimum_trust_level_to_create = 2 + end + + it "validates the post" do + log_in_user(Fabricate(:user, trust_level: 1)) + + post :create, params: { title: title, raw: title }, format: :json + + expect(response.status).to eq(200) + post_id = response.parsed_body["id"] + + log_in_user(Fabricate(:admin)) + + put :update, params: { + id: post_id, post: { raw: "#{title}\n[poll]\n- A\n- B\n- C\n[/poll]" } + }, format: :json + + expect(response.status).to eq(200) + expect(response.parsed_body["post"]["polls"][0]["options"][2]["html"]).to eq("C") + end + end end