finn/forgejo
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Link mentioned user in markdown only if they are visible to viewer (#21554)

Browse source 
We need to make sure a user can't confirm the existence of a user with
private visibility

* Follow up on #21533 

### Before
#### User

![image](https://user-images.githubusercontent.com/20454870/197357580-340911d7-1659-4fc9-a9f6-7ed6bc3476b4.png)

#### Admin

![image](https://user-images.githubusercontent.com/20454870/197357676-a8f0ae63-8f80-4221-a9b5-b6311552910a.png)

### After
#### User

![image](https://user-images.githubusercontent.com/20454870/197357536-05616edb-7821-469d-8e51-6f8cb84c1362.png)

#### Admin

![image](https://user-images.githubusercontent.com/20454870/197357703-071fe984-de79-43aa-a77c-a85b046292a4.png)

Signed-off-by: Yarden Shoham <hrsi88@gmail.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
This commit is contained in:
Yarden Shoham 2022-10-23 12:13:52 +03:00 • committed by GitHub
parent afebbf29a9
commit 88a03a6133
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 47 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

37
services/markup/processorhelper_test.go
View file

@ -6,15 +6,48 @@ package markup
import (
"context"
"net/http"
"testing"
"code.gitea.io/gitea/models/db"
"code.gitea.io/gitea/models/unittest"
"code.gitea.io/gitea/models/user"
gitea_context "code.gitea.io/gitea/modules/context"
"github.com/stretchr/testify/assert"
)
func TestProcessorHelper(t *testing.T) {
assert.NoError(t, unittest.PrepareTestDatabase())
assert.True(t, ProcessorHelper().IsUsernameMentionable(context.Background(), "user10"))
assert.False(t, ProcessorHelper().IsUsernameMentionable(context.Background(), "no-such-user"))
userPublic := "user1"
userPrivate := "user31"
userLimited := "user33"
userNoSuch := "no-such-user"
unittest.AssertCount(t, &user.User{Name: userPublic}, 1)
unittest.AssertCount(t, &user.User{Name: userPrivate}, 1)
unittest.AssertCount(t, &user.User{Name: userLimited}, 1)
unittest.AssertCount(t, &user.User{Name: userNoSuch}, 0)
// when using general context, use user's visibility to check
assert.True(t, ProcessorHelper().IsUsernameMentionable(context.Background(), userPublic))
assert.False(t, ProcessorHelper().IsUsernameMentionable(context.Background(), userLimited))
assert.False(t, ProcessorHelper().IsUsernameMentionable(context.Background(), userPrivate))
assert.False(t, ProcessorHelper().IsUsernameMentionable(context.Background(), userNoSuch))
// when using web context, use user.IsUserVisibleToViewer to check
var err error
giteaCtx := &gitea_context.Context{}
giteaCtx.Req, err = http.NewRequest("GET", "/", nil)
assert.NoError(t, err)
giteaCtx.Doer = nil
assert.True(t, ProcessorHelper().IsUsernameMentionable(giteaCtx, userPublic))
assert.False(t, ProcessorHelper().IsUsernameMentionable(giteaCtx, userPrivate))
giteaCtx.Doer, err = user.GetUserByName(db.DefaultContext, userPrivate)
assert.NoError(t, err)
assert.True(t, ProcessorHelper().IsUsernameMentionable(giteaCtx, userPublic))
assert.True(t, ProcessorHelper().IsUsernameMentionable(giteaCtx, userPrivate))
}