jro_apps/redmine Commit - r11216:d1244b31a4c2

Fixed that requesting a message from an invalid forum should respond with 404 (#13232)....

Jean-Philippe Lang -

r11216:d1244b31a4c2

parent child

Context file:

r11216:d1244b31a4c2

Collapse all files

app/controllers/messages_controller.rb +2 -1

             # Redmine - project management software
             # Copyright (C) 2006-2013  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             class MessagesController < ApplicationController
               menu_item :boards
               default_search_scope :messages
               before_filter :find_board, :only => [:new, :preview]
               before_filter :find_attachments, :only => [:preview]
               before_filter :find_message, :except => [:new, :preview]
               before_filter :authorize, :except => [:preview, :edit, :destroy]
               helper :boards
               helper :watchers
               helper :attachments
               include AttachmentsHelper
               REPLIES_PER_PAGE = 25 unless const_defined?(:REPLIES_PER_PAGE)
               # Show a topic and its replies
               def show
                 page = params[:page]
                 # Find the page of the requested reply
                 if params[:r] && page.nil?
                   offset = @topic.children.count(:conditions => ["#{Message.table_name}.id < ?", params[:r].to_i])
                   page = 1 + offset / REPLIES_PER_PAGE
                 end
                 @reply_count = @topic.children.count
                 @reply_pages = Paginator.new @reply_count, REPLIES_PER_PAGE, page
                 @replies =  @topic.children.
                   includes(:author, :attachments, {:board => :project}).
                   reorder("#{Message.table_name}.created_on ASC").
                   limit(@reply_pages.per_page).
                   offset(@reply_pages.offset).
                   all
                 @reply = Message.new(:subject => "RE: #{@message.subject}")
                 render :action => "show", :layout => false if request.xhr?
               end
               # Create a new topic
               def new
                 @message = Message.new
                 @message.author = User.current
                 @message.board = @board
                 @message.safe_attributes = params[:message]
                 if request.post?
                   @message.save_attachments(params[:attachments])
                   if @message.save
                     call_hook(:controller_messages_new_after_save, { :params => params, :message => @message})
                     render_attachment_warning_if_needed(@message)
                     redirect_to board_message_path(@board, @message)
                   end
                 end
               end
               # Reply to a topic
               def reply
                 @reply = Message.new
                 @reply.author = User.current
                 @reply.board = @board
                 @reply.safe_attributes = params[:reply]
                 @topic.children << @reply
                 if !@reply.new_record?
                   call_hook(:controller_messages_reply_after_save, { :params => params, :message => @reply})
                   attachments = Attachment.attach_files(@reply, params[:attachments])
                   render_attachment_warning_if_needed(@reply)
                 end
                 redirect_to board_message_path(@board, @topic, :r => @reply)
               end
               # Edit a message
               def edit
                 (render_403; return false) unless @message.editable_by?(User.current)
                 @message.safe_attributes = params[:message]
                 if request.post? && @message.save
                   attachments = Attachment.attach_files(@message, params[:attachments])
                   render_attachment_warning_if_needed(@message)
                   flash[:notice] = l(:notice_successful_update)
                   @message.reload
                   redirect_to board_message_path(@message.board, @message.root, :r => (@message.parent_id && @message.id))
                 end
               end
               # Delete a messages
               def destroy
                 (render_403; return false) unless @message.destroyable_by?(User.current)
                 r = @message.to_param
                 @message.destroy
                 if @message.parent
                   redirect_to board_message_path(@board, @message.parent, :r => r)
                 else
                   redirect_to project_board_path(@project, @board)
                 end
               end
               def quote
                 @subject = @message.subject
                 @subject = "RE: #{@subject}" unless @subject.starts_with?('RE:')
                 @content = "#{ll(Setting.default_language, :text_user_wrote, @message.author)}\n> "
                 @content << @message.content.to_s.strip.gsub(%r{<pre>((.|\s)*?)</pre>}m, '[...]').gsub(/(\r?\n|\r\n?)/, "\n> ") + "\n\n"
               end
               def preview
                 message = @board.messages.find_by_id(params[:id])
                 @text = (params[:message] || params[:reply])[:content]
                 @previewed = message
                 render :partial => 'common/preview'
               end
             private
               def find_message
-                find_board
+                return unless find_board
                 @message = @board.messages.find(params[:id], :include => :parent)
                 @topic = @message.root
               rescue ActiveRecord::RecordNotFound
                 render_404
               end
               def find_board
                 @board = Board.find(params[:board_id], :include => :project)
                 @project = @board.project
               rescue ActiveRecord::RecordNotFound
                 render_404
+                nil
               end
             end

test/functional/messages_controller_test.rb +5 0

             # Redmine - project management software
             # Copyright (C) 2006-2013  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             require File.expand_path('../../test_helper', __FILE__)
             class MessagesControllerTest < ActionController::TestCase
               fixtures :projects, :users, :members, :member_roles, :roles, :boards, :messages, :enabled_modules
               def setup
                 User.current = nil
               end
               def test_show
                 get :show, :board_id => 1, :id => 1
                 assert_response :success
                 assert_template 'show'
                 assert_not_nil assigns(:board)
                 assert_not_nil assigns(:project)
                 assert_not_nil assigns(:topic)
               end
               def test_show_should_contain_reply_field_tags_for_quoting
                 @request.session[:user_id] = 2
                 get :show, :board_id => 1, :id => 1
                 assert_response :success
                 # tags required by MessagesController#quote
                 assert_tag 'input', :attributes => {:id => 'message_subject'}
                 assert_tag 'textarea', :attributes => {:id => 'message_content'}
                 assert_tag 'div', :attributes => {:id => 'reply'}
               end
               def test_show_with_pagination
                 message = Message.find(1)
                 assert_difference 'Message.count', 30 do
 .times do
                     message.children << Message.new(:subject => 'Reply', :content => 'Reply body', :author_id => 2, :board_id => 1)
                   end
                 end
                 get :show, :board_id => 1, :id => 1, :r => message.children.last(:order => 'id').id
                 assert_response :success
                 assert_template 'show'
                 replies = assigns(:replies)
                 assert_not_nil replies
                 assert !replies.include?(message.children.first(:order => 'id'))
                 assert replies.include?(message.children.last(:order => 'id'))
               end
               def test_show_with_reply_permission
                 @request.session[:user_id] = 2
                 get :show, :board_id => 1, :id => 1
                 assert_response :success
                 assert_template 'show'
                 assert_tag :div, :attributes => { :id => 'reply' },
                                  :descendant => { :tag => 'textarea', :attributes => { :id => 'message_content' } }
               end
               def test_show_message_not_found
                 get :show, :board_id => 1, :id => 99999
                 assert_response 404
               end
+              def test_show_message_from_invalid_board_should_respond_with_404
+                get :show, :board_id => 999, :id => 1
+                assert_response 404
+              end
               def test_get_new
                 @request.session[:user_id] = 2
                 get :new, :board_id => 1
                 assert_response :success
                 assert_template 'new'
               end
               def test_get_new_with_invalid_board
                 @request.session[:user_id] = 2
                 get :new, :board_id => 99
                 assert_response 404
               end
               def test_post_new
                 @request.session[:user_id] = 2
                 ActionMailer::Base.deliveries.clear
                 with_settings :notified_events => %w(message_posted) do
                   post :new, :board_id => 1,
                            :message => { :subject => 'Test created message',
                                          :content => 'Message body'}
                 end
                 message = Message.find_by_subject('Test created message')
                 assert_not_nil message
                 assert_redirected_to "/boards/1/topics/#{message.to_param}"
                 assert_equal 'Message body', message.content
                 assert_equal 2, message.author_id
                 assert_equal 1, message.board_id
                 mail = ActionMailer::Base.deliveries.last
                 assert_not_nil mail
                 assert_equal "[#{message.board.project.name} - #{message.board.name} - msg#{message.root.id}] Test created message", mail.subject
                 assert_mail_body_match 'Message body', mail
                 # author
                 assert mail.bcc.include?('jsmith@somenet.foo')
                 # project member
                 assert mail.bcc.include?('dlopper@somenet.foo')
               end
               def test_get_edit
                 @request.session[:user_id] = 2
                 get :edit, :board_id => 1, :id => 1
                 assert_response :success
                 assert_template 'edit'
               end
               def test_post_edit
                 @request.session[:user_id] = 2
                 post :edit, :board_id => 1, :id => 1,
                             :message => { :subject => 'New subject',
                                           :content => 'New body'}
                 assert_redirected_to '/boards/1/topics/1'
                 message = Message.find(1)
                 assert_equal 'New subject', message.subject
                 assert_equal 'New body', message.content
               end
               def test_post_edit_sticky_and_locked
                 @request.session[:user_id] = 2
                 post :edit, :board_id => 1, :id => 1,
                             :message => { :subject => 'New subject',
                                           :content => 'New body',
                                           :locked => '1',
                                           :sticky => '1'}
                 assert_redirected_to '/boards/1/topics/1'
                 message = Message.find(1)
                 assert_equal true, message.sticky?
                 assert_equal true, message.locked?
               end
               def test_post_edit_should_allow_to_change_board
                 @request.session[:user_id] = 2
                 post :edit, :board_id => 1, :id => 1,
                             :message => { :subject => 'New subject',
                                           :content => 'New body',
                                           :board_id => 2}
                 assert_redirected_to '/boards/2/topics/1'
                 message = Message.find(1)
                 assert_equal Board.find(2), message.board
               end
               def test_reply
                 @request.session[:user_id] = 2
                 post :reply, :board_id => 1, :id => 1, :reply => { :content => 'This is a test reply', :subject => 'Test reply' }
                 reply = Message.order('id DESC').first
                 assert_redirected_to "/boards/1/topics/1?r=#{reply.id}"
                 assert Message.find_by_subject('Test reply')
               end
               def test_destroy_topic
                 @request.session[:user_id] = 2
                 assert_difference 'Message.count', -3 do
                   post :destroy, :board_id => 1, :id => 1
                 end
                 assert_redirected_to '/projects/ecookbook/boards/1'
                 assert_nil Message.find_by_id(1)
               end
               def test_destroy_reply
                 @request.session[:user_id] = 2
                 assert_difference 'Message.count', -1 do
                   post :destroy, :board_id => 1, :id => 2
                 end
                 assert_redirected_to '/boards/1/topics/1?r=2'
                 assert_nil Message.find_by_id(2)
               end
               def test_quote
                 @request.session[:user_id] = 2
                 xhr :get, :quote, :board_id => 1, :id => 3
                 assert_response :success
                 assert_equal 'text/javascript', response.content_type
                 assert_template 'quote'
                 assert_include 'RE: First post', response.body
                 assert_include '> An other reply', response.body
               end
               def test_preview_new
                 @request.session[:user_id] = 2
                 post :preview,
                   :board_id => 1,
                   :message => {:subject => "", :content => "Previewed text"}
                 assert_response :success
                 assert_template 'common/_preview'
               end
               def test_preview_edit
                 @request.session[:user_id] = 2
                 post :preview,
                   :id => 4,
                   :board_id => 1,
                   :message => {:subject => "", :content => "Previewed text"}
                 assert_response :success
                 assert_template 'common/_preview'
               end
             end

General Comments 0

Write
Preview

You need to be logged in to leave comments. Login now

No TODOs yet

	Site-wide shortcuts
/	Use quick search box
g h	Goto home page
g g	Goto my private gists page
g G	Goto my public gists page
g 0-9	Goto bookmarked items from 0-9
n r	New repository page
n g	New gist page

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository access permissions settings
t s	Toggle sidebar on some pages