Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

FIX: should not receive topic invites from ignored users. #14746

Merged
merged 4 commits into from Oct 28, 2021
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
27 changes: 20 additions & 7 deletions app/models/topic.rb
Expand Up @@ -1022,13 +1022,7 @@ def invite(invited_by, username_or_email, group_ids = nil, custom_message = nil)
raise UserExists.new(I18n.t("topic_invite.user_exists"))
end

if MutedUser
.where(user: target_user, muted_user: invited_by)
.joins(:muted_user)
.where('NOT admin AND NOT moderator')
.exists?
raise NotAllowed.new(I18n.t("topic_invite.muted_invitee"))
end
ensure_can_invite!(target_user, invited_by)

if TopicUser
.where(topic: self,
Expand Down Expand Up @@ -1066,6 +1060,22 @@ def invite(invited_by, username_or_email, group_ids = nil, custom_message = nil)
end
end

def ensure_can_invite!(target_user, invited_by)
if MutedUser
.where(user: target_user, muted_user: invited_by)
.joins(:muted_user)
.where('NOT admin AND NOT moderator')
.exists?
raise NotAllowed
elsif IgnoredUser
.where(user: target_user, ignored_user: invited_by)
.joins(:ignored_user)
.where('NOT admin AND NOT moderator')
.exists?
raise NotAllowed
end
end

def email_already_exists_for?(invite)
invite.email_already_exists && private_message?
end
Expand Down Expand Up @@ -1733,6 +1743,9 @@ def incoming_email_addresses(group: nil, received_before: Time.zone.now)
end

def create_invite_notification!(target_user, notification_type, username)
invited_by = User.find_by_username(username)
ensure_can_invite!(target_user, invited_by)

target_user.notifications.create!(
notification_type: notification_type,
topic_id: self.id,
Expand Down
1 change: 0 additions & 1 deletion config/locales/server.en.yml
Expand Up @@ -270,7 +270,6 @@ en:
topic_invite:
failed_to_invite: "The user cannot be invited into this topic without a group membership in either one of the following groups: %{group_names}."
user_exists: "Sorry, that user has already been invited. You may only invite a user to a topic once."
muted_invitee: "Sorry, that user muted you."
muted_topic: "Sorry, that user muted this topic."
receiver_does_not_allow_pm: "Sorry, that user does not allow you to send them private messages."
sender_does_not_allow_pm: "Sorry, you do not allow that user to send you private messages."
Expand Down
17 changes: 14 additions & 3 deletions spec/models/topic_spec.rb
Expand Up @@ -711,12 +711,23 @@ def build_topic_with_title(title)
end

context "from a muted user" do
before { MutedUser.create!(user: another_user, muted_user: user) }
before { Fabricate(:muted_user, user: another_user, muted_user: user) }

it 'fails with an error message' do
it 'fails with an error' do
expect { topic.invite(user, another_user.username) }
.to raise_error(Topic::NotAllowed)
expect(topic.allowed_users).to_not include(another_user)
expect(Post.last).to be_blank
expect(Notification.last).to be_blank
end
end

context "from a ignored user" do
before { Fabricate(:ignored_user, user: another_user, ignored_user: user) }

it 'fails with an error' do
expect { topic.invite(user, another_user.username) }
.to raise_error(Topic::NotAllowed)
.with_message(I18n.t("topic_invite.muted_invitee"))
expect(topic.allowed_users).to_not include(another_user)
expect(Post.last).to be_blank
expect(Notification.last).to be_blank
Expand Down