ahtlon/deck
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

Merge pull request #2118 from nextcloud/bugfix/noid/attachment-id-check

Browse Source
This commit is contained in:
Julius Härtl
2020-07-13 11:47:47 +02:00
committed by GitHub
parent e5445505de 6114c28b10
commit 06aad4bc10
8 changed files with 72 additions and 96 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
lib/Controller/AttachmentApiController.php
View File

@@ -54,8 +54,7 @@ class AttachmentApiController extends ApiController {
*
*/
public function display() {
$attachment = $this->attachmentService->display($this->request->getParam('cardId'), $this->request->getParam('attachmentId'));
return $attachment;
return $this->attachmentService->display($this->request->getParam('attachmentId'));
}
/**
@@ -76,7 +75,7 @@ class AttachmentApiController extends ApiController {
*
*/
public function update($data) {
$attachment = $this->attachmentService->update($this->request->getParam('cardId'), $this->request->getParam('attachmentId'), $data);
$attachment = $this->attachmentService->update($this->request->getParam('attachmentId'), $data);
return new DataResponse($attachment, HTTP::STATUS_OK);
}
@@ -87,7 +86,7 @@ class AttachmentApiController extends ApiController {
*
*/
public function delete() {
$attachment = $this->attachmentService->delete($this->request->getParam('cardId'), $this->request->getParam('attachmentId'));
$attachment = $this->attachmentService->delete($this->request->getParam('attachmentId'));
return new DataResponse($attachment, HTTP::STATUS_OK);
}
@@ -98,7 +97,7 @@ class AttachmentApiController extends ApiController {
*
*/
public function restore() {
$attachment = $this->attachmentService->restore($this->request->getParam('cardId'), $this->request->getParam('attachmentId'));
$attachment = $this->attachmentService->restore($this->request->getParam('attachmentId'));
return new DataResponse($attachment, HTTP::STATUS_OK);
}
}

16
lib/Controller/AttachmentController.php
View File

@@ -52,8 +52,8 @@ class AttachmentController extends Controller {
* @return \OCP\AppFramework\Http\Response
* @throws \OCA\Deck\NotFoundException
*/
public function display($cardId, $attachmentId) {
return $this->attachmentService->display($cardId, $attachmentId);
public function display($attachmentId) {
return $this->attachmentService->display($attachmentId);
}
/**
@@ -70,21 +70,21 @@ class AttachmentController extends Controller {
/**
* @NoAdminRequired
*/
public function update($cardId, $attachmentId) {
return $this->attachmentService->update($cardId, $attachmentId, $this->request->getParam('data'));
public function update($attachmentId) {
return $this->attachmentService->update($attachmentId, $this->request->getParam('data'));
}
/**
* @NoAdminRequired
*/
public function delete($cardId, $attachmentId) {
return $this->attachmentService->delete($cardId, $attachmentId);
public function delete($attachmentId) {
return $this->attachmentService->delete($attachmentId);
}
/**
* @NoAdminRequired
*/
public function restore($cardId, $attachmentId) {
return $this->attachmentService->restore($cardId, $attachmentId);
public function restore($attachmentId) {
return $this->attachmentService->restore($attachmentId);
}
}

67
lib/Service/AttachmentService.php
View File

@@ -213,7 +213,6 @@ class AttachmentService {
/**
* Display the attachment
*
* @param $cardId
* @param $attachmentId
* @return Response
* @throws BadRequestException
@@ -222,17 +221,17 @@ class AttachmentService {
* @throws \OCP\AppFramework\Db\DoesNotExistException
* @throws \OCP\AppFramework\Db\MultipleObjectsReturnedException
*/
public function display($cardId, $attachmentId) {
if (is_numeric($cardId) === false) {
throw new BadRequestException('card id must be a number');
}
public function display($attachmentId) {
if (is_numeric($attachmentId) === false) {
throw new BadRequestException('attachment id must be a number');
}
$this->permissionService->checkPermission($this->cardMapper, $cardId, Acl::PERMISSION_READ);
$attachment = $this->attachmentMapper->find($attachmentId);
try {
$attachment = $this->attachmentMapper->find($attachmentId);
} catch (\Exception $e) {
throw new NoPermissionException('Permission denied');
}
$this->permissionService->checkPermission($this->cardMapper, $attachment->getCardId(), Acl::PERMISSION_READ);
try {
$service = $this->getService($attachment->getType());
@@ -245,7 +244,6 @@ class AttachmentService {
/**
* Update an attachment with custom data
*
* @param $cardId
* @param $attachmentId
* @param $request
* @return mixed
@@ -254,11 +252,7 @@ class AttachmentService {
* @throws \OCP\AppFramework\Db\MultipleObjectsReturnedException
* @throws BadRequestException
*/
public function update($cardId, $attachmentId, $data) {
if (is_numeric($cardId) === false) {
throw new BadRequestException('card id must be a number');
}
public function update($attachmentId, $data) {
if (is_numeric($attachmentId) === false) {
throw new BadRequestException('attachment id must be a number');
}
@@ -266,11 +260,15 @@ class AttachmentService {
if ($data === false || $data === null) {
//throw new BadRequestException('data must be provided');
}
try {
$attachment = $this->attachmentMapper->find($attachmentId);
} catch (\Exception $e) {
throw new NoPermissionException('Permission denied');
}
$this->permissionService->checkPermission($this->cardMapper, $cardId, Acl::PERMISSION_EDIT);
$this->cache->clear('card-' . $cardId);
$this->permissionService->checkPermission($this->cardMapper, $attachment->getCardId(), Acl::PERMISSION_EDIT);
$this->cache->clear('card-' . $attachment->getCardId());
$attachment = $this->attachmentMapper->find($attachmentId);
$attachment->setData($data);
try {
$service = $this->getService($attachment->getType());
@@ -296,7 +294,6 @@ class AttachmentService {
* Either mark an attachment as deleted for later removal or just remove it depending
* on the IAttachmentService implementation
*
* @param $cardId
* @param $attachmentId
* @return \OCP\AppFramework\Db\Entity
* @throws \OCA\Deck\NoPermissionException
@@ -304,19 +301,20 @@ class AttachmentService {
* @throws \OCP\AppFramework\Db\MultipleObjectsReturnedException
* @throws BadRequestException
*/
public function delete($cardId, $attachmentId) {
if (is_numeric($cardId) === false) {
throw new BadRequestException('card id must be a number');
}
public function delete($attachmentId) {
if (is_numeric($attachmentId) === false) {
throw new BadRequestException('attachment id must be a number');
}
$this->permissionService->checkPermission($this->cardMapper, $cardId, Acl::PERMISSION_EDIT);
$this->cache->clear('card-' . $cardId);
try {
$attachment = $this->attachmentMapper->find($attachmentId);
} catch (\Exception $e) {
throw new NoPermissionException('Permission denied');
}
$this->permissionService->checkPermission($this->cardMapper, $attachment->getCardId(), Acl::PERMISSION_EDIT);
$this->cache->clear('card-' . $attachment->getCardId());
$attachment = $this->attachmentMapper->find($attachmentId);
try {
$service = $this->getService($attachment->getType());
if ($service->allowUndo()) {
@@ -334,19 +332,20 @@ class AttachmentService {
return $attachment;
}
public function restore($cardId, $attachmentId) {
if (is_numeric($cardId) === false) {
throw new BadRequestException('card id must be a number');
}
public function restore($attachmentId) {
if (is_numeric($attachmentId) === false) {
throw new BadRequestException('attachment id must be a number');
}
$this->permissionService->checkPermission($this->cardMapper, $cardId, Acl::PERMISSION_EDIT);
$this->cache->clear('card-' . $cardId);
try {
$attachment = $this->attachmentMapper->find($attachmentId);
} catch (\Exception $e) {
throw new NoPermissionException('Permission denied');
}
$this->permissionService->checkPermission($this->cardMapper, $attachment->getCardId(), Acl::PERMISSION_EDIT);
$this->cache->clear('card-' . $attachment->getCardId());
$attachment = $this->attachmentMapper->find($attachmentId);
try {
$service = $this->getService($attachment->getType());
if ($service->allowUndo()) {

2
lib/Service/PermissionService.php
View File

@@ -133,7 +133,7 @@ class PermissionService {
*/
public function checkPermission($mapper, $id, $permission, $userId = null) {
$boardId = $id;
if ($mapper instanceof IPermissionMapper) {
if ($mapper instanceof IPermissionMapper && !($mapper instanceof BoardMapper)) {
$boardId = $mapper->findBoardId($id);
}
if ($boardId === null) {

4
lib/Service/StackService.php
View File

@@ -147,9 +147,7 @@ class StackService {
}
public function fetchDeleted($boardId) {
$this->permissionService->checkPermission(
$this->boardMapper, $boardId, Acl::PERMISSION_READ
);
$this->permissionService->checkPermission($this->boardMapper, $boardId, Acl::PERMISSION_READ);
$stacks = $this->stackMapper->findDeleted($boardId);
$this->enrichStacksWithCards($stacks);

15
tests/unit/Service/AttachmentServiceTest.php
View File

@@ -155,6 +155,7 @@ class AttachmentServiceTest extends TestCase {
$attachment = new Attachment();
$attachment->setType($type);
$attachment->setData($data);
$attachment->setCardId(123);
return $attachment;
}
@@ -255,7 +256,7 @@ class AttachmentServiceTest extends TestCase {
->method('display')
->with($attachment)
->willReturn($response);
$actual = $this->attachmentService->display(123, 1);
$actual = $this->attachmentService->display(1);
$this->assertEquals($response, $actual);
}
@@ -272,7 +273,7 @@ class AttachmentServiceTest extends TestCase {
->method('display')
->with($attachment)
->will($this->throwException(new InvalidAttachmentType('deck_file')));
$this->attachmentService->display(123, 1);
$this->attachmentService->display(1);
}
public function testUpdate() {
$attachment = $this->createAttachment('deck_file', 'file_name.jpg');
@@ -294,7 +295,7 @@ class AttachmentServiceTest extends TestCase {
$a->setExtendedData(['mime' => 'image/jpeg']);
});
$actual = $this->attachmentService->update(123, 1, 'file_name.jpg');
$actual = $this->attachmentService->update(1, 'file_name.jpg');
$expected->setExtendedData(['mime' => 'image/jpeg']);
$expected->setLastModified($attachment->getLastModified());
@@ -318,7 +319,7 @@ class AttachmentServiceTest extends TestCase {
$this->attachmentMapper->expects($this->once())
->method('delete')
->willReturn($attachment);
$actual = $this->attachmentService->delete(123, 1);
$actual = $this->attachmentService->delete(1);
$this->assertEquals($expected, $actual);
}
@@ -343,7 +344,7 @@ class AttachmentServiceTest extends TestCase {
->method('update')
->willReturn($attachment);
$expected->setDeletedAt(23);
$actual = $this->attachmentService->delete(123, 1);
$actual = $this->attachmentService->delete(1);
$this->assertEquals($expected, $actual);
}
@@ -363,7 +364,7 @@ class AttachmentServiceTest extends TestCase {
->method('update')
->willReturn($attachment);
$expected->setDeletedAt(0);
$actual = $this->attachmentService->restore(123, 1);
$actual = $this->attachmentService->restore(1);
$this->assertEquals($expected, $actual);
}
@@ -380,6 +381,6 @@ class AttachmentServiceTest extends TestCase {
$this->attachmentServiceImpl->expects($this->once())
->method('allowUndo')
->willReturn(false);
$actual = $this->attachmentService->restore(123, 1);
$actual = $this->attachmentService->restore(1);
}
}

36
tests/unit/controller/AttachmentApiControllerTest.php
View File

@@ -73,14 +73,9 @@ class AttachmentApiControllerTest extends \Test\TestCase {
->method('display')
->willReturn($this->attachmentExample);
$this->request->expects($this->exactly(2))
$this->request->expects($this->once())
->method('getParam')
->withConsecutive(
['cardId'],
['attachmentId']
)->willReturnonConsecutiveCalls(
$this->cardId,
$this->attachmentExample->getId());
->willReturn($this->attachmentExample->getId());
$expected = $this->attachmentExample;
$actual = $this->controller->display();
@@ -114,14 +109,9 @@ class AttachmentApiControllerTest extends \Test\TestCase {
->method('update')
->willReturn($this->attachmentExample);
$this->request->expects($this->exactly(2))
$this->request->expects($this->once())
->method('getParam')
->withConsecutive(
['cardId'],
['attachmentId']
)->willReturnonConsecutiveCalls(
$this->cardId,
$this->attachmentExample->getId());
->willReturn($this->attachmentExample->getId());
$expected = new DataResponse($this->attachmentExample, HTTP::STATUS_OK);
$actual = $this->controller->update($data);
@@ -133,14 +123,9 @@ class AttachmentApiControllerTest extends \Test\TestCase {
->method('delete')
->willReturn($this->attachmentExample);
$this->request->expects($this->exactly(2))
$this->request->expects($this->once())
->method('getParam')
->withConsecutive(
['cardId'],
['attachmentId']
)->willReturnonConsecutiveCalls(
$this->cardId,
$this->attachmentExample->getId());
->willReturn($this->attachmentExample->getId());
$expected = new DataResponse($this->attachmentExample, HTTP::STATUS_OK);
$actual = $this->controller->delete();
@@ -152,14 +137,9 @@ class AttachmentApiControllerTest extends \Test\TestCase {
->method('restore')
->willReturn($this->attachmentExample);
$this->request->expects($this->exactly(2))
$this->request->expects($this->once())
->method('getParam')
->withConsecutive(
['cardId'],
['attachmentId']
)->willReturnonConsecutiveCalls(
$this->cardId,
$this->attachmentExample->getId());
->willReturn($this->attachmentExample->getId());
$expected = new DataResponse($this->attachmentExample, HTTP::STATUS_OK);
$actual = $this->controller->restore();

19
tests/unit/controller/AttachmentControllerTest.php
View File

@@ -44,8 +44,7 @@ class AttachmentControllerTest extends \Test\TestCase {
$this->controller = new AttachmentController(
'deck',
$this->request,
$this->attachmentService,
$this->userId
$this->attachmentService
);
}
@@ -55,8 +54,8 @@ class AttachmentControllerTest extends \Test\TestCase {
}
public function testDisplay() {
$this->attachmentService->expects($this->once())->method('display')->with(1, 2);
$this->controller->display(1, 2);
$this->attachmentService->expects($this->once())->method('display')->with(2);
$this->controller->display(2);
}
public function testCreate() {
@@ -76,25 +75,25 @@ class AttachmentControllerTest extends \Test\TestCase {
->will($this->onConsecutiveCalls('data'));
$this->attachmentService->expects($this->once())
->method('update')
->with(1, 2, 'data')
->with(2, 'data')
->willReturn(1);
$this->assertEquals(1, $this->controller->update(1, 2));
$this->assertEquals(1, $this->controller->update(2));
}
public function testDelete() {
$this->attachmentService->expects($this->once())
->method('delete')
->with(123, 234)
->with(234)
->willReturn(1);
$this->assertEquals(1, $this->controller->delete(123, 234));
$this->assertEquals(1, $this->controller->delete(234));
}
public function testRestore() {
$this->attachmentService->expects($this->once())
->method('restore')
->with(123, 234)
->with(234)
->willReturn(1);
$this->assertEquals(1, $this->controller->restore(123, 234));
$this->assertEquals(1, $this->controller->restore(234));
}
}