fix voting access for restricted users - #2116
Conversation
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files
☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
| return | ||
| end | ||
|
|
||
| if !current_user.privilege?('unrestricted') && !current_user.owns_post_or_parent?(post) |
There was a problem hiding this comment.
Let's make it a proper access control method on the user model. Something along the lines of can_vote_on?(post)
There was a problem hiding this comment.
I moved the new test into a method on the model as you suggested. I did not also do the site-setting check there, because the can_something? methods by convention return booleans, but here we have two different error messages for the two reasons you might not be allowed to vote.
There was a problem hiding this comment.
According to rubocop, the user model is now too long by two lines. I didn't find any obvious opportunities for consolidating that don't compromise legibility.
2 participants
Fixes #2114. After checking for trying to vote on your own post, the votes controller now also checks if you are missing the "unrestricted" ability and this isn't an answer to your question. It's important that this is the second check, because we're calling
owns_post_or_parent?instead of writing a new very similar check. If it's your post we've already bailed, so this is really just checking whether you own the parent.I tested this manually with restricted and unrestricted users voting on their own posts, answers to their questions, and unrelated posts. I also pre-emptively ran rubocop before committing, so I'm not sure what's up with that test failure here.