Permalink
Browse files

FIX Check for stage and drafts in SiteTree::canView()

  • Loading branch information...
simonwelsh committed Aug 8, 2013
1 parent d017286 commit b1664f86a430e52f65d12019ef4367eaa7a96c4e
Showing with 24 additions and 2 deletions.
  1. +17 −0 code/model/SiteTree.php
  2. +7 −2 tests/search/SearchFormTest.php
View
@@ -787,6 +787,23 @@ public function canView($member = null) {
// admin override
if($member && Permission::checkMember($member, array("ADMIN", "SITETREE_VIEW_ALL"))) return true;
+ // make sure we were loaded off an allowed stage
+
+ // Were we definitely loaded directly off Live during our query?
+ $fromLive = true;
+
+ foreach (array('mode' => 'stage', 'stage' => 'live') as $param => $match) {
+ $fromLive = $fromLive && strtolower((string)$this->getSourceQueryParam("Versioned.$param")) == $match;
+ }
+
+ if(!$fromLive
+ && !Session::get('unsecuredDraftSite')
+ && !Permission::checkMember($member, array('CMS_ACCESS_CMSMain', 'VIEW_DRAFT_CONTENT'))) {
+ // If we weren't definitely loaded from live, and we can't view non-live content, we need to
+ // check to make sure this version is the live version and so can be viewed
+ if (Versioned::get_versionnumber_by_stage($this->class, 'Live', $this->ID) != $this->Version) return false;
+ }
+
// Standard mechanism for accepting permission changes from extensions
$extended = $this->extendedCan('canView', $member);
if($extended !== null) return $extended;
@@ -88,6 +88,7 @@ public function testPagesRestrictedToLoggedinUsersNotIncluded() {
$sf = new SearchForm($this->mockController, 'SearchForm');
$page = $this->objFromFixture('SiteTree', 'restrictedViewLoggedInUsers');
+ $page->publish('Stage', 'Live');
$results = $sf->getResults(null, array('Search'=>'restrictedViewLoggedInUsers'));
$this->assertNotContains(
$page->ID,
@@ -110,6 +111,7 @@ public function testPagesRestrictedToSpecificGroupNotIncluded() {
$sf = new SearchForm($this->mockController, 'SearchForm');
$page = $this->objFromFixture('SiteTree', 'restrictedViewOnlyWebsiteUsers');
+ $page->publish('Stage', 'Live');
$results = $sf->getResults(null, array('Search'=>'restrictedViewOnlyWebsiteUsers'));
$this->assertNotContains(
$page->ID,
@@ -138,11 +140,14 @@ public function testPagesRestrictedToSpecificGroupNotIncluded() {
$member->logOut();
}
- public function testInheritedRestrictedPagesNotInlucded() {
+ public function testInheritedRestrictedPagesNotIncluded() {
$sf = new SearchForm($this->mockController, 'SearchForm');
+
+ $parent = $this->objFromFixture('SiteTree', 'restrictedViewLoggedInUsers');
+ $parent->publish('Stage', 'Live');
$page = $this->objFromFixture('SiteTree', 'inheritRestrictedView');
-
+ $page->publish('Stage', 'Live');
$results = $sf->getResults(null, array('Search'=>'inheritRestrictedView'));
$this->assertNotContains(
$page->ID,

0 comments on commit b1664f8

Please sign in to comment.