Commit e515f284 authored by Mark Harding's avatar Mark Harding
Browse files

(fix): Do ACL check to prevent non-group members leaving comments in conversations

parent 95b30fc7

Core/Comments/Manager.php

+1 −1
Original line number Original line Diff line number Diff line
@@ -126,7 +126,7 @@ class Manager 




        $owner = $comment->getOwnerEntity(false);

        $owner = $comment->getOwnerEntity(false);





        if (!$this->acl->interact($entity->guid, $owner, "comment")) {

        if (!$this->acl->interact($entity, $owner, "comment")) {

            throw new \Exception();

            throw new \Exception();

        }

        }

Core/Groups/Events.php

+11 −0
Original line number Original line Diff line number Diff line
@@ -75,6 +75,17 @@ class Events 
            $e->setResponse(($group->isOwner($user->guid) || $group->isModerator($user->guid)) && $group->isMember($user->guid));

            $e->setResponse(($group->isOwner($user->guid) || $group->isModerator($user->guid)) && $group->isMember($user->guid));

        });

        });





        Dispatcher::register('acl:interact', 'group', function ($e) {

            $params = $e->getParameters();

            $group = $params['entity'];

            $user = $params['user'];

            $interaction = $params['interaction'];



            if ($group instanceof GroupEntity && $interaction === 'comment') {

                $e->setResponse($group->isMember($user->guid));

            }

        });



        Dispatcher::register('delete', 'activity', function ($e) {

        Dispatcher::register('delete', 'activity', function ($e) {

            $params = $e->getParameters();

            $params = $e->getParameters();

            $activity = $params['entity'];

            $activity = $params['entity'];

Spec/Core/Comments/ManagerSpec.php

+9 −9
Original line number Original line Diff line number Diff line
@@ -102,11 +102,11 @@ class ManagerSpec extends ObjectBehavior 
            ->shouldBeCalled()

            ->shouldBeCalled()

            ->willReturn($entity);

            ->willReturn($entity);





        $entity->get('guid')

        /*$entity->get('guid')

            ->shouldBeCalled()

            ->shouldBeCalled()

            ->willReturn(5000);

            ->willReturn(5000);*/





        $this->acl->interact(5000, $owner, 'comment')

        $this->acl->interact($entity, $owner, 'comment')

            ->shouldBeCalled()

            ->shouldBeCalled()

            ->willReturn(true);

            ->willReturn(true);
@@ -169,11 +169,11 @@ class ManagerSpec extends ObjectBehavior 
            ->shouldBeCalled()

            ->shouldBeCalled()

            ->willReturn($entity);

            ->willReturn($entity);





        $entity->get('guid')

        /*$entity->get('guid')

            ->shouldBeCalled()

            ->shouldBeCalled()

            ->willReturn(100);

            ->willReturn(100);*/





        $this->acl->interact(100, $owner, "comment")

        $this->acl->interact($entity, $owner, "comment")

            ->shouldBeCalled()

            ->shouldBeCalled()

            ->willReturn(false);

            ->willReturn(false);
@@ -204,11 +204,11 @@ class ManagerSpec extends ObjectBehavior 
            ->shouldBeCalled()

            ->shouldBeCalled()

            ->willReturn($entity);

            ->willReturn($entity);





        $entity->get('guid')

        /*$entity->get('guid')

            ->shouldBeCalled()

            ->shouldBeCalled()

            ->willReturn(100);

            ->willReturn(100);*/





        $this->acl->interact(100, $owner, "comment")

        $this->acl->interact($entity, $owner, "comment")

            ->shouldBeCalled()

            ->shouldBeCalled()

            ->willReturn(true);

            ->willReturn(true);