mirror/php-flarum
1
0
Fork 0
mirror of https://github.com/flarum/core.git synced 2025-08-04 15:37:51 +02:00
Code Issues Releases Wiki Activity

[1.x] [suspend] fix: previously suspended admin users cannot remove their avatar after suspension (#4071)

Browse Source 
* [1.x][suspend] fix: formally suspended admin users cannot remove their avatar after suspension

* Apply fixes from StyleCI

---------

Co-authored-by: StyleCI Bot <bot@styleci.io>
This commit is contained in:
IanM
2024-10-15 12:10:55 +01:00
committed by GitHub
parent 5bd7e5dfe3
commit 3a45ebc716
2 changed files with 7 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
extensions/suspend/src/Listener/PreventAvatarDeletionBySuspendedUser.php
View File

@@ -18,7 +18,7 @@ class PreventAvatarDeletionBySuspendedUser
$actor = $event->actor;
$user = $event->user;
if ($actor->id === $user->id && $user->suspended_until) {
if (! $actor->isAdmin() && $actor->id === $user->id && $user->suspended_until && $user->suspended_until->isFuture()) {
throw new PermissionDeniedException();
}
}

7
extensions/suspend/tests/integration/api/users/RemoveAvatarTest.php
View File

@@ -31,12 +31,14 @@ class RemoveAvatarTest extends TestCase
['id' => 3, 'username' => 'acme', 'email' => 'acme@machine.local', 'is_email_confirmed' => 1, 'suspended_until' => Carbon::now()->addDay(), 'suspend_message' => 'You have been suspended.', 'suspend_reason' => 'Suspended for acme reasons.'],
['id' => 4, 'username' => 'acme4', 'email' => 'acme4@machine.local', 'is_email_confirmed' => 1],
['id' => 5, 'username' => 'acme5', 'email' => 'acme5@machine.local', 'is_email_confirmed' => 1, 'suspended_until' => Carbon::now()->subDay(), 'suspend_message' => 'You have been suspended.', 'suspend_reason' => 'Suspended for acme reasons.'],
['id' => 6, 'username' => 'acme6', 'email' => 'acme6@machine.local', 'is_email_confirmed' => 1, 'suspended_until' => Carbon::now()->subWeek(), 'suspend_message' => 'You have been suspended.', 'suspend_reason' => 'Suspended for acme reasons.'],
],
'groups' => [
['id' => 5, 'name_singular' => 'can_edit_users', 'name_plural' => 'can_edit_users', 'is_hidden' => 0]
],
'group_user' => [
['user_id' => 2, 'group_id' => 5]
['user_id' => 2, 'group_id' => 5],
['user_id' => 6, 'group_id' => 1],
],
'group_permission' => [
['permission' => 'user.edit', 'group_id' => 5],
@@ -73,6 +75,9 @@ class RemoveAvatarTest extends TestCase
[4, 4, 'Normal user can remove their own avatar'],
[1, 3, 'Admin can remove avatar of suspended user'],
[2, 3, 'Normal user with permission can remove avatar of suspended user'],
[1, 6, 'Admin can remove avatar of expired suspended user'],
[2, 6, 'Normal user with permission can remove avatar of expired suspended user'],
[6, 6, 'Admin user can remove avatar if they have an expired suspension'],
];
}