From 95db5f0c8cf83f2db781b1a9491aba323fc38af5 Mon Sep 17 00:00:00 2001
From: Gerhard Schlager <mail@gerhard-schlager.at>
Date: Tue, 22 May 2018 13:41:32 +0200
Subject: [PATCH] FIX: Do not replace wrong avatars when renaming user

---
 app/jobs/regular/update_username.rb    | 24 ++++++++++++++--
 spec/services/username_changer_spec.rb | 40 +++++++++++++++++++++++++-
 2 files changed, 60 insertions(+), 4 deletions(-)

diff --git a/app/jobs/regular/update_username.rb b/app/jobs/regular/update_username.rb
index e8a45d9366..ae877a44e1 100644
--- a/app/jobs/regular/update_username.rb
+++ b/app/jobs/regular/update_username.rb
@@ -133,14 +133,32 @@ module Jobs
         a["href"] = a["href"].gsub(@cooked_mention_user_path_regex, "/u/#{@new_username}") if a["href"]
       end
 
-      doc.css("aside.quote > div.title").each do |div|
+      doc.css("aside.quote").each do |aside|
+        next unless div = aside.at_css("div.title")
+
+        username_replaced = false
+
         div.children.each do |child|
-          child.content = child.content.gsub(@cooked_quote_username_regex, @new_username) if child.text?
+          if child.text?
+            content = child.content
+            username_replaced = content.gsub!(@cooked_quote_username_regex, @new_username).present?
+            child.content = content if username_replaced
+          end
+        end
+
+        if username_replaced || quotes_correct_user?(aside)
+          div.at_css("img.avatar")&.replace(@avatar_img)
         end
-        div.at_css("img.avatar")&.replace(@avatar_img)
       end
 
       doc.to_html
     end
+
+    def quotes_correct_user?(aside)
+      Post.where(
+        topic_id: aside["data-topic"],
+        post_number: aside["data-post"]
+      ).pluck(:user_id).first == @user_id
+    end
   end
 end
diff --git a/spec/services/username_changer_spec.rb b/spec/services/username_changer_spec.rb
index 1057813707..92bdb27a57 100644
--- a/spec/services/username_changer_spec.rb
+++ b/spec/services/username_changer_spec.rb
@@ -405,12 +405,18 @@ describe UsernameChanger do
 
       context 'oneboxes' do
         let(:quoted_post) { create_post(user: user, topic: topic, post_number: 1, raw: "quoted post") }
-        let(:avatar_url) { user.avatar_template.gsub("{size}", "40") }
+        let(:avatar_url) { user_avatar_url(user) }
+        let(:evil_trout) { Fabricate(:evil_trout) }
+        let(:another_quoted_post) { create_post(user: evil_trout, topic: topic, post_number: 2, raw: "evil post") }
 
         def protocol_relative_url(url)
           url.sub(/^https?:/, '')
         end
 
+        def user_avatar_url(u)
+          u.avatar_template.gsub("{size}", "40")
+        end
+
         it 'updates avatar for linked topics and posts' do
           raw = "#{quoted_post.full_url}\n#{quoted_post.topic.url}"
           post = create_post_and_change_username(raw: raw)
@@ -442,6 +448,38 @@ describe UsernameChanger do
             </p>
           HTML
         end
+
+        it 'does not update the wrong avatar' do
+          raw = "#{quoted_post.full_url}\n#{another_quoted_post.full_url}"
+          post = create_post_and_change_username(raw: raw)
+
+          expect(post.raw).to eq(raw)
+
+          expect(post.cooked).to match_html(<<~HTML)
+            <p><aside class="quote" data-post="#{quoted_post.post_number}" data-topic="#{quoted_post.topic.id}">
+              <div class="title">
+                <div class="quote-controls"></div>
+                <img alt="" width="20" height="20" src="#{avatar_url}" class="avatar">
+                <a href="#{protocol_relative_url(quoted_post.full_url)}">#{quoted_post.topic.title}</a>
+              </div>
+              <blockquote>
+                quoted post
+              </blockquote>
+            </aside>
+            <br>
+            <aside class="quote" data-post="#{another_quoted_post.post_number}" data-topic="#{another_quoted_post.topic.id}">
+              <div class="title">
+                <div class="quote-controls"></div>
+                <img alt="" width="20" height="20" src="#{user_avatar_url(evil_trout)}" class="avatar">
+                <a href="#{protocol_relative_url(another_quoted_post.full_url)}">#{another_quoted_post.topic.title}</a>
+              </div>
+              <blockquote>
+                evil post
+              </blockquote>
+            </aside>
+            </p>
+          HTML
+        end
       end
 
       it 'updates username in small action posts' do