FIX: Don't allow users to edit topic information when the OP is locked

see:
https://meta.discourse.org/t/user-able-to-edit-title-of-locked-post/104826
This commit is contained in:
Robin Ward 2019-06-18 14:22:38 -04:00
parent 6fec4982d9
commit e8b9f38374
2 changed files with 13 additions and 1 deletions

View File

@ -97,7 +97,9 @@ module TopicGuardian
)
return false if topic.archived
is_my_own?(topic) && !topic.edit_time_limit_expired?
is_my_own?(topic) &&
!topic.edit_time_limit_expired? &&
!Post.where(topic_id: topic.id, post_number: 1).where.not(locked_by_id: nil).exists?
end
# Recovery Method

View File

@ -1419,6 +1419,16 @@ describe Guardian do
expect(Guardian.new(coding_horror).can_edit?(topic)).to be_falsey
end
context "locked" do
let(:post) { Fabricate(:post, locked_by_id: admin.id) }
let(:topic) { post.topic }
it "doesn't allow users to edit locked topics" do
expect(Guardian.new(topic.user).can_edit?(topic)).to eq(false)
expect(Guardian.new(admin).can_edit?(topic)).to eq(true)
end
end
context 'not archived' do
it 'returns true as a moderator' do
expect(Guardian.new(moderator).can_edit?(topic)).to eq(true)