Mirrors/BookStack
1
0
Fork 0
mirror of https://github.com/BookStackApp/BookStack.git synced 2024-11-23 11:22:33 +01:00
Code Issues Releases Wiki Activity

Fixed issue where restricted page content in plaintext export

Browse Source 
The content of pages made non-viewable to a user via permissions, within a visible parent, could be seen via the plaintext export option. Before v0.30.6 this would have applied only to scenarios where all pages within the chapter were made non-visible. In v0.30.6 this would make all pages within the chapter visible.

As per #2414
This commit is contained in:
Dan Brown 2020-12-18 13:56:00 +00:00
parent 3f3fad7113
commit 2acef3c2ec
No known key found for this signature in database
GPG Key ID: 46D9F943C24A2EF9
3 changed files with 70 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
app/Entities/ExportService.php
View File

@ -203,7 +203,7 @@ class ExportService
{
$text = $chapter->name . "\n\n";
$text .= $chapter->description . "\n\n";
foreach ($chapter->pages as $page) {
foreach ($chapter->getVisiblePages() as $page) {
$text .= $this->pageToPlainText($page);
}
return $text;
@ -214,7 +214,7 @@ class ExportService
*/
public function bookToPlainText(Book $book): string
{
$bookTree = (new BookContents($book))->getTree(false, true);
$bookTree = (new BookContents($book))->getTree(false, false);
$text = $book->name . "\n\n";
foreach ($bookTree as $bookChild) {
if ($bookChild->isA('chapter')) {

2
app/Uploads/ImageRepo.php
View File

@ -112,7 +112,7 @@ class ImageRepo
if ($filterType === 'page') {
$query->where('uploaded_to', '=', $contextPage->id);
} elseif ($filterType === 'book') {
$validPageIds = $contextPage->book->pages()->get(['id'])->pluck('id')->toArray();
$validPageIds = $contextPage->book->pages()->visible()->get(['id'])->pluck('id')->toArray();
$query->whereIn('uploaded_to', $validPageIds);
}
};

67
tests/Permissions/ExportPermissionsTest.php Normal file
View File

@ -0,0 +1,67 @@
<?php namespace Tests\Permissions;
use BookStack\Entities\Book;
use BookStack\Entities\Chapter;
use Illuminate\Support\Str;
use Tests\TestCase;
class ExportPermissionsTest extends TestCase
{
public function test_page_content_without_view_access_hidden_on_chapter_export()
{
$chapter = Chapter::query()->first();
$page = $chapter->pages()->firstOrFail();
$pageContent = Str::random(48);
$page->html = '<p>' . $pageContent . '</p>';
$page->save();
$viewer = $this->getViewer();
$this->actingAs($viewer);
$formats = ['html', 'plaintext'];
foreach ($formats as $format) {
$resp = $this->get($chapter->getUrl("export/{$format}"));
$resp->assertStatus(200);
$resp->assertSee($page->name);
$resp->assertSee($pageContent);
}
$this->setEntityRestrictions($page, []);
foreach ($formats as $format) {
$resp = $this->get($chapter->getUrl("export/{$format}"));
$resp->assertStatus(200);
$resp->assertDontSee($page->name);
$resp->assertDontSee($pageContent);
}
}
public function test_page_content_without_view_access_hidden_on_book_export()
{
$book = Book::query()->first();
$page = $book->pages()->firstOrFail();
$pageContent = Str::random(48);
$page->html = '<p>' . $pageContent . '</p>';
$page->save();
$viewer = $this->getViewer();
$this->actingAs($viewer);
$formats = ['html', 'plaintext'];
foreach ($formats as $format) {
$resp = $this->get($book->getUrl("export/{$format}"));
$resp->assertStatus(200);
$resp->assertSee($page->name);
$resp->assertSee($pageContent);
}
$this->setEntityRestrictions($page, []);
foreach ($formats as $format) {
$resp = $this->get($book->getUrl("export/{$format}"));
$resp->assertStatus(200);
$resp->assertDontSee($page->name);
$resp->assertDontSee($pageContent);
}
}
}