jro_apps/redmine Commit - r1400:04766697357b

Wiki page protection (#851, patch #1146 by Mateo Murphy with slight changes)....

Jean-Philippe Lang -

r1400:04766697357b

parent child

Context file:

r1400:04766697357b

Collapse all files

db/migrate/093_add_wiki_pages_protected.rb created 644 +9 0

@@ -0,0 +1,9
	1	class AddWikiPagesProtected < ActiveRecord::Migration
	2	def self.up
	3	add_column :wiki_pages, :protected, :boolean, :default => false, :null => false
	4	end
	5
	6	def self.down
	7	remove_column :wiki_pages, :protected
	8	end
	9	end

app/controllers/wiki_controller.rb +20 -2

               layout 'base'
               before_filter :find_wiki, :authorize
-              verify :method => :post, :only => [:destroy, :destroy_attachment], :redirect_to => { :action => :index }
+              verify :method => :post, :only => [:destroy, :destroy_attachment, :protect], :redirect_to => { :action => :index }
               helper :attachments
               include AttachmentsHelper
                   send_data(@content.text, :type => 'text/plain', :filename => "#{@page.title}.txt")
                   return
                 end
+            	@editable = editable?
                 render :action => 'show'
               end
               # edit an existing page or a new one
               def edit
                 @page = @wiki.find_or_new_page(params[:page])
+                return render_403 unless editable?
                 @page.content = WikiContent.new(:page => @page) if @page.new_record?
                 @content = @page.content_for_version(params[:version])
               # rename a page
               def rename
                 @page = @wiki.find_page(params[:page])
+            	return render_403 unless editable?
                 @page.redirect_existing_links = true
                 # used to display the *original* title if some AR validation errors occur
                 @original_title = @page.pretty_title
                 end
               end
+              def protect
+                page = @wiki.find_page(params[:page])
+                page.update_attribute :protected, params[:protected]
+                redirect_to :action => 'index', :id => @project, :page => page.title
+              end
               # show page history
               def history
                 @page = @wiki.find_page(params[:page])
               # remove a wiki page and its history
               def destroy
                 @page = @wiki.find_page(params[:page])
+            	return render_403 unless editable?
                 @page.destroy if @page
                 redirect_to :action => 'special', :id => @project, :page => 'Page_index'
               end
               def preview
                 page = @wiki.find_page(params[:page])
+                return render_403 unless editable?(page)
                 @attachements = page.attachments if page
                 @text = params[:content][:text]
                 render :partial => 'common/preview'
               def add_attachment
                 @page = @wiki.find_page(params[:page])
+                return render_403 unless editable?
                 attach_files(@page, params[:attachments])
                 redirect_to :action => 'index', :page => @page.title
               end
               def destroy_attachment
                 @page = @wiki.find_page(params[:page])
+                return render_403 unless editable?
                 @page.attachments.find(params[:attachment_id]).destroy
                 redirect_to :action => 'index', :page => @page.title
               end
               rescue ActiveRecord::RecordNotFound
                 render_404
               end
+              # Returns true if the current user is allowed to edit the page, otherwise false
+              def editable?(page = @page)
+                page.editable_by?(User.current)
+              end
             end

app/models/wiki_page.rb +5 0

               def text
                 content.text if content
               end
+              # Returns true if usr is allowed to edit the page, otherwise false
+              def editable_by?(usr)
+                !protected? || usr.allowed_to?(:protect_wiki_pages, wiki.project)
+              end
             end
             class WikiDiff

app/views/wiki/show.rhtml +6 -2

             <div class="contextual">
+            <% if @editable %>
             <%= link_to_if_authorized(l(:button_edit), {:action => 'edit', :page => @page.title}, :class => 'icon icon-edit', :accesskey => accesskey(:edit)) if @content.version == @page.content.version %>
+            <%= link_to_if_authorized(l(:button_lock), {:action => 'protect', :page => @page.title, :protected => 1}, :method => :post, :class => 'icon icon-lock') if !@page.protected? %>
+            <%= link_to_if_authorized(l(:button_unlock), {:action => 'protect', :page => @page.title, :protected => 0}, :method => :post, :class => 'icon icon-unlock') if @page.protected? %>
             <%= link_to_if_authorized(l(:button_rename), {:action => 'rename', :page => @page.title}, :class => 'icon icon-move') if @content.version == @page.content.version %>
             <%= link_to_if_authorized(l(:button_delete), {:action => 'destroy', :page => @page.title}, :method => :post, :confirm => l(:text_are_you_sure), :class => 'icon icon-del') %>
             <%= link_to_if_authorized(l(:button_rollback), {:action => 'edit', :page => @page.title, :version => @content.version }, :class => 'icon icon-cancel') if @content.version < @page.content.version %>
+            <% end %>
             <%= link_to(l(:label_history), {:action => 'history', :page => @page.title}, :class => 'icon icon-history') %>
             </div>
             <%= render(:partial => "wiki/content", :locals => {:content => @content}) %>
-            <%= link_to_attachments @page.attachments, :delete_url => (authorize_for('wiki', 'destroy_attachment') ? {:controller => 'wiki', :action => 'destroy_attachment', :page => @page.title} : nil) %>
+            <%= link_to_attachments @page.attachments, :delete_url => ((@editable && authorize_for('wiki', 'destroy_attachment')) ? {:controller => 'wiki', :action => 'destroy_attachment', :page => @page.title} : nil) %>
-            <% if authorize_for('wiki', 'add_attachment') %>
+            <% if @editable && authorize_for('wiki', 'add_attachment') %>
             <p><%= link_to l(:label_attachment_new), {}, :onclick => "Element.show('add_attachment_form'); Element.hide(this); Element.scrollTo('add_attachment_form'); return false;",
                                                          :id => 'attach_files_link' %></p>
             <% form_tag({ :controller => 'wiki', :action => 'add_attachment', :page => @page.title }, :multipart => true, :id => "add_attachment_form", :style => "display:none;") do %>

lib/redmine.rb +1 0

                 map.permission :delete_wiki_pages, {:wiki => :destroy}, :require => :member
                 map.permission :view_wiki_pages, :wiki => [:index, :history, :diff, :annotate, :special]
                 map.permission :edit_wiki_pages, :wiki => [:edit, :preview, :add_attachment, :destroy_attachment]
+                map.permission :protect_wiki_pages, {:wiki => :protect}, :require => :member
               end
               map.project_module :repository do |map|

public/images/locked.png binary modified 0 0

NO CONTENT: modified file, binary diff hidden

public/images/unlock.png binary modified 0 0

NO CONTENT: modified file, binary diff hidden

test/fixtures/roles.yml +2 0

                 - :manage_documents
                 - :view_wiki_pages
                 - :edit_wiki_pages
+                - :protect_wiki_pages
                 - :delete_wiki_pages
                 - :rename_wiki_pages
                 - :add_messages
                 - :manage_documents
                 - :view_wiki_pages
                 - :edit_wiki_pages
+                - :protect_wiki_pages
                 - :delete_wiki_pages
                 - :add_messages
                 - :manage_boards

test/fixtures/wiki_pages.yml +4 0

               title: CookBook_documentation
               id: 1
               wiki_id: 1
+              protected: true
             wiki_pages_002:
               created_on: 2007-03-08 00:18:07 +01:00
               title: Another_page
               id: 2
               wiki_id: 1
+              protected: false
             wiki_pages_003:
               created_on: 2007-03-08 00:18:07 +01:00
               title: Start_page
               id: 3
               wiki_id: 2
+              protected: false
             wiki_pages_004:
               created_on: 2007-03-08 00:18:07 +01:00
               title: Page_with_an_inline_image
               id: 4
               wiki_id: 1
+              protected: false
   No newline at end of file

test/functional/wiki_controller_test.rb +56 0

@@ -160,4 +160,60 class WikiControllerTest < Test::Unit::TestCase
160	get :index, :id => 999	160	get :index, :id => 999
161	assert_response 404	161	assert_response 404
162	end	162	end
		163
		164	def test_protect_page
		165	page = WikiPage.find_by_wiki_id_and_title(1, 'Another_page')
		166	assert !page.protected?
		167	@request.session[:user_id] = 2
		168	post :protect, :id => 1, :page => page.title, :protected => '1'
		169	assert_redirected_to 'wiki/ecookbook/Another_page'
		170	assert page.reload.protected?
		171	end
		172
		173	def test_unprotect_page
		174	page = WikiPage.find_by_wiki_id_and_title(1, 'CookBook_documentation')
		175	assert page.protected?
		176	@request.session[:user_id] = 2
		177	post :protect, :id => 1, :page => page.title, :protected => '0'
		178	assert_redirected_to 'wiki/ecookbook'
		179	assert !page.reload.protected?
		180	end
		181
		182	def test_show_page_with_edit_link
		183	@request.session[:user_id] = 2
		184	get :index, :id => 1
		185	assert_response :success
		186	assert_template 'show'
		187	assert_tag :tag => 'a', :attributes => { :href => '/wiki/1/CookBook_documentation/edit' }
		188	end
		189
		190	def test_show_page_without_edit_link
		191	@request.session[:user_id] = 4
		192	get :index, :id => 1
		193	assert_response :success
		194	assert_template 'show'
		195	assert_no_tag :tag => 'a', :attributes => { :href => '/wiki/1/CookBook_documentation/edit' }
		196	end
		197
		198	def test_edit_unprotected_page
		199	# Non members can edit unprotected wiki pages
		200	@request.session[:user_id] = 4
		201	get :edit, :id => 1, :page => 'Another_page'
		202	assert_response :success
		203	assert_template 'edit'
		204	end
		205
		206	def test_edit_protected_page_by_nonmember
		207	# Non members can't edit protected wiki pages
		208	@request.session[:user_id] = 4
		209	get :edit, :id => 1, :page => 'CookBook_documentation'
		210	assert_response 403
		211	end
		212
		213	def test_edit_protected_page_by_member
		214	@request.session[:user_id] = 2
		215	get :edit, :id => 1, :page => 'CookBook_documentation'
		216	assert_response :success
		217	assert_template 'edit'
		218	end
163	end	219	end

General Comments 0

Write
Preview

You need to be logged in to leave comments. Login now

No TODOs yet

	Site-wide shortcuts
/	Use quick search box
g h	Goto home page
g g	Goto my private gists page
g G	Goto my public gists page
g 0-9	Goto bookmarked items from 0-9
n r	New repository page
n g	New gist page

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository access permissions settings
t s	Toggle sidebar on some pages