jro_apps/redmine Commit - r2143:ede011243b0e

Check that wiki page exists before processing (#2360)....

Jean-Philippe Lang -

r2143:ede011243b0e

parent child

Context file:

r2143:ede011243b0e

Collapse all files

app/controllers/wiki_controller.rb +13 -13

             # redMine - project management software
             # Copyright (C) 2006-2007  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             require 'diff'
             class WikiController < ApplicationController
               before_filter :find_wiki, :authorize
+              before_filter :find_existing_page, :only => [:rename, :protect, :history, :diff, :annotate, :add_attachment, :destroy]
               verify :method => :post, :only => [:destroy, :protect], :redirect_to => { :action => :index }
               helper :attachments
               include AttachmentsHelper
               # display a page (in editing mode if it doesn't exist)
               def index
                 page_title = params[:page]
                 @page = @wiki.find_or_new_page(page_title)
                 if @page.new_record?
                   if User.current.allowed_to?(:edit_wiki_pages, @project)
                     edit
                     render :action => 'edit'
                   else
                     render_404
                   end
                   return
                 end
                 if params[:version] && !User.current.allowed_to?(:view_wiki_edits, @project)
                   # Redirects user to the current version if he's not allowed to view previous versions
                   redirect_to :version => nil
                   return
                 end
                 @content = @page.content_for_version(params[:version])
                 if params[:export] == 'html'
                   export = render_to_string :action => 'export', :layout => false
                   send_data(export, :type => 'text/html', :filename => "#{@page.title}.html")
                   return
                 elsif params[:export] == 'txt'
                   send_data(@content.text, :type => 'text/plain', :filename => "#{@page.title}.txt")
                   return
                 end
             	@editable = editable?
                 render :action => 'show'
               end
               # edit an existing page or a new one
               def edit
                 @page = @wiki.find_or_new_page(params[:page])
                 return render_403 unless editable?
                 @page.content = WikiContent.new(:page => @page) if @page.new_record?
                 @content = @page.content_for_version(params[:version])
                 @content.text = initial_page_content(@page) if @content.text.blank?
                 # don't keep previous comment
                 @content.comments = nil
                 if request.get?
                   # To prevent StaleObjectError exception when reverting to a previous version
                   @content.version = @page.content.version
                 else
                   if !@page.new_record? && @content.text == params[:content][:text]
                     # don't save if text wasn't changed
                     redirect_to :action => 'index', :id => @project, :page => @page.title
                     return
                   end
                   #@content.text = params[:content][:text]
                   #@content.comments = params[:content][:comments]
                   @content.attributes = params[:content]
                   @content.author = User.current
                   # if page is new @page.save will also save content, but not if page isn't a new record
                   if (@page.new_record? ? @page.save : @content.save)
                     redirect_to :action => 'index', :id => @project, :page => @page.title
                   end
                 end
               rescue ActiveRecord::StaleObjectError
                 # Optimistic locking exception
                 flash[:error] = l(:notice_locking_conflict)
               end
               # rename a page
               def rename
-                @page = @wiki.find_page(params[:page])
+                return render_403 unless editable?
-            	return render_403 unless editable?
                 @page.redirect_existing_links = true
                 # used to display the *original* title if some AR validation errors occur
                 @original_title = @page.pretty_title
                 if request.post? && @page.update_attributes(params[:wiki_page])
                   flash[:notice] = l(:notice_successful_update)
                   redirect_to :action => 'index', :id => @project, :page => @page.title
                 end
               end
               def protect
-                page = @wiki.find_page(params[:page])
+                @page.update_attribute :protected, params[:protected]
-                page.update_attribute :protected, params[:protected]
+                redirect_to :action => 'index', :id => @project, :page => @page.title
-                redirect_to :action => 'index', :id => @project, :page => page.title
               end
               # show page history
               def history
-                @page = @wiki.find_page(params[:page])
                 @version_count = @page.content.versions.count
                 @version_pages = Paginator.new self, @version_count, per_page_option, params['p']
                 # don't load text
                 @versions = @page.content.versions.find :all,
                                                         :select => "id, author_id, comments, updated_on, version",
                                                         :order => 'version DESC',
                                                         :limit  =>  @version_pages.items_per_page + 1,
                                                         :offset =>  @version_pages.current.offset
                 render :layout => false if request.xhr?
               end
               def diff
-                @page = @wiki.find_page(params[:page])
                 @diff = @page.diff(params[:version], params[:version_from])
                 render_404 unless @diff
               end
               def annotate
-                @page = @wiki.find_page(params[:page])
                 @annotate = @page.annotate(params[:version])
+                render_404 unless @annotate
               end
               # remove a wiki page and its history
               def destroy
-                @page = @wiki.find_page(params[:page])
+                return render_403 unless editable?
-            	return render_403 unless editable?
+                @page.destroy
-                @page.destroy if @page
                 redirect_to :action => 'special', :id => @project, :page => 'Page_index'
               end
               # display special pages
               def special
                 page_title = params[:page].downcase
                 case page_title
                 # show pages index, sorted by title
                 when 'page_index', 'date_index'
                   # eager load information about last updates, without loading text
                   @pages = @wiki.pages.find :all, :select => "#{WikiPage.table_name}.*, #{WikiContent.table_name}.updated_on",
                                                   :joins => "LEFT JOIN #{WikiContent.table_name} ON #{WikiContent.table_name}.page_id = #{WikiPage.table_name}.id",
                                                   :order => 'title'
                   @pages_by_date = @pages.group_by {|p| p.updated_on.to_date}
                   @pages_by_parent_id = @pages.group_by(&:parent_id)
                 # export wiki to a single html file
                 when 'export'
                   @pages = @wiki.pages.find :all, :order => 'title'
                   export = render_to_string :action => 'export_multiple', :layout => false
                   send_data(export, :type => 'text/html', :filename => "wiki.html")
                   return
                 else
                   # requested special page doesn't exist, redirect to default page
                   redirect_to :action => 'index', :id => @project, :page => nil and return
                 end
                 render :action => "special_#{page_title}"
               end
               def preview
                 page = @wiki.find_page(params[:page])
                 # page is nil when previewing a new page
                 return render_403 unless page.nil? || editable?(page)
                 if page
                   @attachements = page.attachments
                   @previewed = page.content
                 end
                 @text = params[:content][:text]
                 render :partial => 'common/preview'
               end
               def add_attachment
-                @page = @wiki.find_page(params[:page])
                 return render_403 unless editable?
                 attach_files(@page, params[:attachments])
                 redirect_to :action => 'index', :page => @page.title
               end
             private
               def find_wiki
                 @project = Project.find(params[:id])
                 @wiki = @project.wiki
                 render_404 unless @wiki
               rescue ActiveRecord::RecordNotFound
                 render_404
               end
+              # Finds the requested page and returns a 404 error if it doesn't exist
+              def find_existing_page
+                @page = @wiki.find_page(params[:page])
+                render_404 if @page.nil?
+              end
               # Returns true if the current user is allowed to edit the page, otherwise false
               def editable?(page = @page)
                 page.editable_by?(User.current)
               end
               # Returns the default content of a new wiki page
               def initial_page_content(page)
                 helper = Redmine::WikiFormatting.helper_for(Setting.text_formatting)
                 extend helper unless self.instance_of?(helper)
                 helper.instance_method(:initial_page_content).bind(self).call(page)
               end
             end

test/functional/wiki_controller_test.rb +5 0

             # redMine - project management software
             # Copyright (C) 2006-2007  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             require File.dirname(__FILE__) + '/../test_helper'
             require 'wiki_controller'
             # Re-raise errors caught by the controller.
             class WikiController; def rescue_action(e) raise e end; end
             class WikiControllerTest < Test::Unit::TestCase
               fixtures :projects, :users, :roles, :members, :enabled_modules, :wikis, :wiki_pages, :wiki_contents, :wiki_content_versions, :attachments
               def setup
                 @controller = WikiController.new
                 @request    = ActionController::TestRequest.new
                 @response   = ActionController::TestResponse.new
                 User.current = nil
               end
               def test_show_start_page
                 get :index, :id => 'ecookbook'
                 assert_response :success
                 assert_template 'show'
                 assert_tag :tag => 'h1', :content => /CookBook documentation/
                 # child_pages macro
                 assert_tag :ul, :attributes => { :class => 'pages-hierarchy' },
                            :child => { :tag => 'li',
                                        :child => { :tag => 'a', :attributes => { :href => '/wiki/ecookbook/Page_with_an_inline_image' },
                                                                 :content => 'Page with an inline image' } }
               end
               def test_show_page_with_name
                 get :index, :id => 1, :page => 'Another_page'
                 assert_response :success
                 assert_template 'show'
                 assert_tag :tag => 'h1', :content => /Another page/
                 # Included page with an inline image
                 assert_tag :tag => 'p', :content => /This is an inline image/
                 assert_tag :tag => 'img', :attributes => { :src => '/attachments/download/3',
                                                            :alt => 'This is a logo' }
               end
               def test_show_unexistent_page_without_edit_right
                 get :index, :id => 1, :page => 'Unexistent page'
                 assert_response 404
               end
               def test_show_unexistent_page_with_edit_right
                 @request.session[:user_id] = 2
                 get :index, :id => 1, :page => 'Unexistent page'
                 assert_response :success
                 assert_template 'edit'
               end
               def test_create_page
                 @request.session[:user_id] = 2
                 post :edit, :id => 1,
                             :page => 'New page',
                             :content => {:comments => 'Created the page',
                                          :text => "h1. New page\n\nThis is a new page",
                                          :version => 0}
                 assert_redirected_to 'wiki/ecookbook/New_page'
                 page = Project.find(1).wiki.find_page('New page')
                 assert !page.new_record?
                 assert_not_nil page.content
                 assert_equal 'Created the page', page.content.comments
               end
               def test_preview
                 @request.session[:user_id] = 2
                 xhr :post, :preview, :id => 1, :page => 'CookBook_documentation',
                                                :content => { :comments => '',
                                                              :text => 'this is a *previewed text*',
                                                              :version => 3 }
                 assert_response :success
                 assert_template 'common/_preview'
                 assert_tag :tag => 'strong', :content => /previewed text/
               end
               def test_preview_new_page
                 @request.session[:user_id] = 2
                 xhr :post, :preview, :id => 1, :page => 'New page',
                                                :content => { :text => 'h1. New page',
                                                              :comments => '',
                                                              :version => 0 }
                 assert_response :success
                 assert_template 'common/_preview'
                 assert_tag :tag => 'h1', :content => /New page/
               end
               def test_history
                 get :history, :id => 1, :page => 'CookBook_documentation'
                 assert_response :success
                 assert_template 'history'
                 assert_not_nil assigns(:versions)
                 assert_equal 3, assigns(:versions).size
                 assert_select "input[type=submit][name=commit]"
               end
               def test_history_with_one_version
                 get :history, :id => 1, :page => 'Another_page'
                 assert_response :success
                 assert_template 'history'
                 assert_not_nil assigns(:versions)
                 assert_equal 1, assigns(:versions).size
                 assert_select "input[type=submit][name=commit]", false
               end
               def test_diff
                 get :diff, :id => 1, :page => 'CookBook_documentation', :version => 2, :version_from => 1
                 assert_response :success
                 assert_template 'diff'
                 assert_tag :tag => 'span', :attributes => { :class => 'diff_in'},
                                            :content => /updated/
               end
               def test_annotate
                 get :annotate, :id => 1, :page =>  'CookBook_documentation', :version => 2
                 assert_response :success
                 assert_template 'annotate'
                 # Line 1
                 assert_tag :tag => 'tr', :child => { :tag => 'th', :attributes => {:class => 'line-num'}, :content => '1' },
                                          :child => { :tag => 'td', :attributes => {:class => 'author'}, :content => /John Smith/ },
                                          :child => { :tag => 'td', :content => /h1\. CookBook documentation/ }
                 # Line 2
                 assert_tag :tag => 'tr', :child => { :tag => 'th', :attributes => {:class => 'line-num'}, :content => '2' },
                                          :child => { :tag => 'td', :attributes => {:class => 'author'}, :content => /redMine Admin/ },
                                          :child => { :tag => 'td', :content => /Some updated \[\[documentation\]\] here/ }
               end
               def test_rename_with_redirect
                 @request.session[:user_id] = 2
                 post :rename, :id => 1, :page => 'Another_page',
                                         :wiki_page => { :title => 'Another renamed page',
                                                         :redirect_existing_links => 1 }
                 assert_redirected_to 'wiki/ecookbook/Another_renamed_page'
                 wiki = Project.find(1).wiki
                 # Check redirects
                 assert_not_nil wiki.find_page('Another page')
                 assert_nil wiki.find_page('Another page', :with_redirect => false)
               end
               def test_rename_without_redirect
                 @request.session[:user_id] = 2
                 post :rename, :id => 1, :page => 'Another_page',
                                         :wiki_page => { :title => 'Another renamed page',
                                                         :redirect_existing_links => "0" }
                 assert_redirected_to 'wiki/ecookbook/Another_renamed_page'
                 wiki = Project.find(1).wiki
                 # Check that there's no redirects
                 assert_nil wiki.find_page('Another page')
               end
               def test_destroy
                 @request.session[:user_id] = 2
                 post :destroy, :id => 1, :page => 'CookBook_documentation'
                 assert_redirected_to 'wiki/ecookbook/Page_index/special'
               end
               def test_page_index
                 get :special, :id => 'ecookbook', :page => 'Page_index'
                 assert_response :success
                 assert_template 'special_page_index'
                 pages = assigns(:pages)
                 assert_not_nil pages
                 assert_equal Project.find(1).wiki.pages.size, pages.size
                 assert_tag :ul, :attributes => { :class => 'pages-hierarchy' },
                                 :child => { :tag => 'li', :child => { :tag => 'a', :attributes => { :href => '/wiki/ecookbook/CookBook_documentation' },
                                                           :content => 'CookBook documentation' },
                                             :child => { :tag => 'ul',
                                                         :child => { :tag => 'li',
                                                                     :child => { :tag => 'a', :attributes => { :href => '/wiki/ecookbook/Page_with_an_inline_image' },
                                                                                              :content => 'Page with an inline image' } } } },
                                 :child => { :tag => 'li', :child => { :tag => 'a', :attributes => { :href => '/wiki/ecookbook/Another_page' },
                                                                                    :content => 'Another page' } }
               end
               def test_not_found
                 get :index, :id => 999
                 assert_response 404
               end
               def test_protect_page
                 page = WikiPage.find_by_wiki_id_and_title(1, 'Another_page')
                 assert !page.protected?
                 @request.session[:user_id] = 2
                 post :protect, :id => 1, :page => page.title, :protected => '1'
                 assert_redirected_to 'wiki/ecookbook/Another_page'
                 assert page.reload.protected?
               end
               def test_unprotect_page
                 page = WikiPage.find_by_wiki_id_and_title(1, 'CookBook_documentation')
                 assert page.protected?
                 @request.session[:user_id] = 2
                 post :protect, :id => 1, :page => page.title, :protected => '0'
                 assert_redirected_to 'wiki/ecookbook'
                 assert !page.reload.protected?
               end
               def test_show_page_with_edit_link
                 @request.session[:user_id] = 2
                 get :index, :id => 1
                 assert_response :success
                 assert_template 'show'
                 assert_tag :tag => 'a', :attributes => { :href => '/wiki/1/CookBook_documentation/edit' }
               end
               def test_show_page_without_edit_link
                 @request.session[:user_id] = 4
                 get :index, :id => 1
                 assert_response :success
                 assert_template 'show'
                 assert_no_tag :tag => 'a', :attributes => { :href => '/wiki/1/CookBook_documentation/edit' }
               end
               def test_edit_unprotected_page
                 # Non members can edit unprotected wiki pages
                 @request.session[:user_id] = 4
                 get :edit, :id => 1, :page => 'Another_page'
                 assert_response :success
                 assert_template 'edit'
               end
               def test_edit_protected_page_by_nonmember
                 # Non members can't edit protected wiki pages
                 @request.session[:user_id] = 4
                 get :edit, :id => 1, :page => 'CookBook_documentation'
                 assert_response 403
               end
               def test_edit_protected_page_by_member
                 @request.session[:user_id] = 2
                 get :edit, :id => 1, :page => 'CookBook_documentation'
                 assert_response :success
                 assert_template 'edit'
               end
+              def test_history_of_non_existing_page_should_return_404
+                get :history, :id => 1, :page => 'Unknown_page'
+                assert_response 404
+              end
             end

General Comments 0

Write
Preview

You need to be logged in to leave comments. Login now

No TODOs yet

	Site-wide shortcuts
/	Use quick search box
g h	Goto home page
g g	Goto my private gists page
g G	Goto my public gists page
g 0-9	Goto bookmarked items from 0-9
n r	New repository page
n g	New gist page

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository access permissions settings
t s	Toggle sidebar on some pages