jro_apps/redmine Commit - r2143:ede011243b0e

Check that wiki page exists before processing (#2360)....

Jean-Philippe Lang -

r2143:ede011243b0e

parent child

Context file:

r2143:ede011243b0e

Collapse all files

app/controllers/wiki_controller.rb +13 -13

             class WikiController < ApplicationController
               before_filter :find_wiki, :authorize
+              before_filter :find_existing_page, :only => [:rename, :protect, :history, :diff, :annotate, :add_attachment, :destroy]
               verify :method => :post, :only => [:destroy, :protect], :redirect_to => { :action => :index }
               # rename a page
               def rename
-                @page = @wiki.find_page(params[:page])
+                return render_403 unless editable?
-            	return render_403 unless editable?
                 @page.redirect_existing_links = true
                 # used to display the *original* title if some AR validation errors occur
                 @original_title = @page.pretty_title
               end
               def protect
-                page = @wiki.find_page(params[:page])
+                @page.update_attribute :protected, params[:protected]
-                page.update_attribute :protected, params[:protected]
+                redirect_to :action => 'index', :id => @project, :page => @page.title
-                redirect_to :action => 'index', :id => @project, :page => page.title
               end
               # show page history
               def history
-                @page = @wiki.find_page(params[:page])
                 @version_count = @page.content.versions.count
                 @version_pages = Paginator.new self, @version_count, per_page_option, params['p']
                 # don't load text
               end
               def diff
-                @page = @wiki.find_page(params[:page])
                 @diff = @page.diff(params[:version], params[:version_from])
                 render_404 unless @diff
               end
               def annotate
-                @page = @wiki.find_page(params[:page])
                 @annotate = @page.annotate(params[:version])
+                render_404 unless @annotate
               end
               # remove a wiki page and its history
               def destroy
-                @page = @wiki.find_page(params[:page])
+                return render_403 unless editable?
-            	return render_403 unless editable?
+                @page.destroy
-                @page.destroy if @page
                 redirect_to :action => 'special', :id => @project, :page => 'Page_index'
               end
               end
               def add_attachment
-                @page = @wiki.find_page(params[:page])
                 return render_403 unless editable?
                 attach_files(@page, params[:attachments])
                 redirect_to :action => 'index', :page => @page.title
                 render_404
               end
+              # Finds the requested page and returns a 404 error if it doesn't exist
+              def find_existing_page
+                @page = @wiki.find_page(params[:page])
+                render_404 if @page.nil?
+              end
               # Returns true if the current user is allowed to edit the page, otherwise false
               def editable?(page = @page)
                 page.editable_by?(User.current)

test/functional/wiki_controller_test.rb +5 0

                 assert_response :success
                 assert_template 'edit'
               end
+              def test_history_of_non_existing_page_should_return_404
+                get :history, :id => 1, :page => 'Unknown_page'
+                assert_response 404
+              end
             end

General Comments 0

Write
Preview

You need to be logged in to leave comments. Login now

No TODOs yet

	Site-wide shortcuts
/	Use quick search box
g h	Goto home page
g g	Goto my private gists page
g G	Goto my public gists page
g 0-9	Goto bookmarked items from 0-9
n r	New repository page
n g	New gist page

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository access permissions settings
t s	Toggle sidebar on some pages