This repository has been archived on 2023-03-18. You can view files and clone it, but cannot push or open issues or pull requests.
osr-discourse-src/app/assets/javascripts/discourse/tests/acceptance/share-topic-test.js
Alan Guo Xiang Tan 8f6d54a920 SECURITY: Category group permissions leaked to normal users.
After this commit, category group permissions can only be seen by users
that are allowed to manage a category. In the past, we inadvertently
included a category's group permissions settings in `CategoriesController#show`
and `CategoriesController#find_by_slug` endpoints for normal users when
those settings are only a concern to users that can manage a category.
2022-04-08 11:04:40 +02:00

133 lines
3.6 KiB
JavaScript
Raw Blame History

This file contains ambiguous Unicode characters

This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

import CategoryFixtures from "discourse/tests/fixtures/category-fixtures";
import I18n from "I18n";
import { click, visit } from "@ember/test-helpers";
import {
acceptance,
exists,
query,
queryAll,
} from "discourse/tests/helpers/qunit-helpers";
import selectKit from "discourse/tests/helpers/select-kit-helper";
import { test } from "qunit";
acceptance("Share and Invite modal", function (needs) {
needs.user();
needs.pretender((server, helper) => {
server.get(`/c/2481/visible_groups.json`, () =>
helper.response(200, {
groups: ["group_name_1", "group_name_2"],
})
);
server.get(`/c/2/visible_groups.json`, () =>
helper.response(200, {
groups: [],
})
);
});
test("Topic footer button", async function (assert) {
await visit("/t/internationalization-localization/280");
assert.ok(
exists("#topic-footer-button-share-and-invite"),
"the button exists"
);
await click("#topic-footer-button-share-and-invite");
assert.ok(exists(".share-topic-modal"), "it shows the modal");
assert.notOk(
exists("#modal-alert.alert-warning"),
"it does not show the alert with restricted groups"
);
assert.ok(
queryAll("input.invite-link")
.val()
.includes("/t/internationalization-localization/280?u=eviltrout"),
"it shows the topic sharing url"
);
assert.ok(
exists(".link-share-actions .invite"),
"it shows the invite button"
);
});
test("Post date link", async function (assert) {
await visit("/t/short-topic-with-two-posts/54077");
await click("#post_2 .post-info.post-date a");
assert.ok(exists(".share-topic-modal"), "it shows the share modal");
});
test("Share topic in a restricted category", async function (assert) {
await visit("/t/topic-in-restricted-group/2481");
assert.ok(
exists("#topic-footer-button-share-and-invite"),
"the button exists"
);
await click("#topic-footer-button-share-and-invite");
assert.ok(exists(".share-topic-modal"), "it shows the modal");
assert.ok(
exists("#modal-alert.alert-warning"),
"it shows restricted warning"
);
assert.strictEqual(
query("#modal-alert.alert-warning").innerText,
I18n.t("topic.share.restricted_groups", {
count: 2,
groupNames: "group_name_1, group_name_2",
}),
"it shows correct restricted group name"
);
});
});
acceptance("Share and Invite modal - mobile", function (needs) {
needs.user();
needs.mobileView();
test("Topic footer mobile button", async function (assert) {
await visit("/t/internationalization-localization/280");
assert.ok(
!exists("#topic-footer-button-share-and-invite"),
"the button doesnt exist"
);
const subject = selectKit(".topic-footer-mobile-dropdown");
await subject.expand();
await subject.selectRowByValue("share-and-invite");
assert.ok(exists(".share-topic-modal"), "it shows the modal");
});
});
acceptance("Share url with badges disabled - desktop", function (needs) {
needs.user();
needs.settings({ enable_badges: false });
needs.pretender((server, helper) => {
server.get("/c/feature/find_by_slug.json", () =>
helper.response(200, CategoryFixtures["/c/1/show.json"])
);
});
test("topic footer button - badges disabled - desktop", async function (assert) {
await visit("/t/internationalization-localization/280");
await click("#topic-footer-button-share-and-invite");
assert.notOk(
queryAll("input.invite-link").val().includes("?u=eviltrout"),
"it doesn't add the username param when badges are disabled"
);
});
});