From 685ba1eb7f019de4c6bcfffd3def68147fbcb516 Mon Sep 17 00:00:00 2001
From: Neil Lalonde <neillalonde@gmail.com>
Date: Fri, 22 Jan 2016 12:54:18 -0500
Subject: [PATCH] FEATURE: blocked users can send and reply to private messages
 from staff

---
 .../controllers/user-private-messages.js.es6  |  1 +
 .../discourse/templates/user/messages.hbs     |  2 +-
 app/controllers/posts_controller.rb           |  8 ----
 lib/guardian.rb                               |  4 +-
 lib/guardian/post_guardian.rb                 |  2 +-
 spec/components/guardian_spec.rb              | 43 ++++++++++++++++++-
 6 files changed, 47 insertions(+), 13 deletions(-)

diff --git a/app/assets/javascripts/discourse/controllers/user-private-messages.js.es6 b/app/assets/javascripts/discourse/controllers/user-private-messages.js.es6
index 09dc372daa9..69aa202d94d 100644
--- a/app/assets/javascripts/discourse/controllers/user-private-messages.js.es6
+++ b/app/assets/javascripts/discourse/controllers/user-private-messages.js.es6
@@ -10,6 +10,7 @@ export default Ember.Controller.extend({
 
   selected: Em.computed.alias('controllers.user-topics-list.selected'),
   bulkSelectEnabled: Em.computed.alias('controllers.user-topics-list.bulkSelectEnabled'),
+  showNewPM: Em.computed.alias('controllers.user-topics-list.showNewPM'),
 
   @computed('selected.@each', 'bulkSelectEnabled')
   hasSelection(selected, bulkSelectEnabled){
diff --git a/app/assets/javascripts/discourse/templates/user/messages.hbs b/app/assets/javascripts/discourse/templates/user/messages.hbs
index 3961669981a..130c79257dc 100644
--- a/app/assets/javascripts/discourse/templates/user/messages.hbs
+++ b/app/assets/javascripts/discourse/templates/user/messages.hbs
@@ -1,5 +1,5 @@
 <section class='user-navigation'>
-  {{#if viewingSelf}}
+  {{#if showNewPM}}
   {{d-button class="btn-primary new-private-message" action="composePrivateMessage" icon="envelope" label="user.new_private_message"}}
   {{/if}}
   <ul class='action-list nav-stacked'>
diff --git a/app/controllers/posts_controller.rb b/app/controllers/posts_controller.rb
index fa12041d41b..553e0e036c5 100644
--- a/app/controllers/posts_controller.rb
+++ b/app/controllers/posts_controller.rb
@@ -96,14 +96,6 @@ class PostsController < ApplicationController
 
   def create
 
-    if !is_api? && current_user.blocked?
-
-      # error has parity with what user would get if they posted when blocked
-      # and it went through post creator
-      render json: {errors: [I18n.t("topic_not_found")]}, status: 422
-      return
-    end
-
     @manager_params = create_params
     @manager_params[:first_post_checks] = !is_api?
 
diff --git a/lib/guardian.rb b/lib/guardian.rb
index 78dcee9cd50..92c09f2ed26 100644
--- a/lib/guardian.rb
+++ b/lib/guardian.rb
@@ -256,7 +256,9 @@ class Guardian
       @user.username == SiteSetting.site_contact_username ||
       @user == Discourse.system_user) &&
     # Can't send PMs to suspended users
-    (is_staff? || target.is_a?(Group) || !target.suspended?)
+    (is_staff? || target.is_a?(Group) || !target.suspended?) &&
+    # Blocked users can only send PM to staff
+    (!@user.blocked? || target.staff?)
   end
 
   def can_see_emails?
diff --git a/lib/guardian/post_guardian.rb b/lib/guardian/post_guardian.rb
index c2296161549..722c0174850 100644
--- a/lib/guardian/post_guardian.rb
+++ b/lib/guardian/post_guardian.rb
@@ -73,7 +73,7 @@ module PostGuardian
 
   # Creating Method
   def can_create_post?(parent)
-    !SpamRule::AutoBlock.block?(@user) && (
+    (!SpamRule::AutoBlock.block?(@user) || (!!parent.try(:private_message?) && parent.allowed_users.include?(@user))) && (
       !parent ||
       !parent.category ||
       Category.post_create_allowed(self).where(:id => parent.category.id).count == 1
diff --git a/spec/components/guardian_spec.rb b/spec/components/guardian_spec.rb
index fe7e29dca8e..35244c52a92 100644
--- a/spec/components/guardian_spec.rb
+++ b/spec/components/guardian_spec.rb
@@ -187,6 +187,22 @@ describe Guardian do
         expect(Guardian.new(user).can_send_private_message?(suspended_user)).to be_falsey
       end
     end
+
+    context "author is blocked" do
+      before do
+        user.blocked = true
+        user.save
+      end
+
+      it "returns true if target is staff" do
+        expect(Guardian.new(user).can_send_private_message?(admin)).to be_truthy
+        expect(Guardian.new(user).can_send_private_message?(moderator)).to be_truthy
+      end
+
+      it "returns false if target is not staff" do
+        expect(Guardian.new(user).can_send_private_message?(another_user)).to be_falsey
+      end
+    end
   end
 
   describe 'can_reply_as_new_topic' do
@@ -661,11 +677,34 @@ describe Guardian do
         it "doesn't allow new posts from admins" do
           expect(Guardian.new(admin).can_create?(Post, topic)).to be_falsey
         end
-
       end
 
+      context "private message" do
+        let(:private_message) { Fabricate(:topic, archetype: Archetype.private_message, category_id: nil) }
 
-    end
+        before { user.save! }
+
+        it "allows new posts by people included in the pm" do
+          private_message.topic_allowed_users.create!(user_id: user.id)
+          expect(Guardian.new(user).can_create?(Post, private_message)).to be_truthy
+        end
+
+        it "doesn't allow new posts by people not invited to the pm" do
+          expect(Guardian.new(user).can_create?(Post, private_message)).to be_falsey
+        end
+
+        it "allows new posts from blocked users included in the pm" do
+          user.update_attribute(:blocked, true)
+          private_message.topic_allowed_users.create!(user_id: user.id)
+          expect(Guardian.new(user).can_create?(Post, private_message)).to be_truthy
+        end
+
+        it "doesn't allow new posts from blocked users not invited to the pm" do
+          user.update_attribute(:blocked, true)
+          expect(Guardian.new(user).can_create?(Post, private_message)).to be_falsey
+        end
+      end
+    end # can_create? a Post
 
   end