fixes /community/joinList?id=* that access block is not considered (f…

…ixes #2636)
openpne · Feb 8, 2017 · 20d13f4 · 20d13f4
1 parent 736bea3
commit 20d13f4
Show file tree

Hide file tree

Showing 2 changed files with 16 additions and 0 deletions.
diff --git a/lib/action/opCommunityAction.class.php b/lib/action/opCommunityAction.class.php
@@ -183,6 +183,7 @@ public function executeJoinlist(opWebRequest $request)
 
     $this->member = Doctrine::getTable('Member')->find($memberId);
     $this->forward404Unless($this->member);
+    $this->forward404Unless($this->member->isAllowed($this->getUser()->getMember(), 'view'));
 
     if (!$this->size)
     {

diff --git a/test/functional/pc_frontend/communityActionsTest.php b/test/functional/pc_frontend/communityActionsTest.php
@@ -76,6 +76,21 @@
   ->with('response')->isStatusCode(200)
 ;
 
+$user->login('[email protected]', 'password');
+$user
+->info('4. Testing `/community/joinList?id=*`')
+->get('/community/joinList?id=1')
+  ->info('4-1. Member E cannot view the list of communities joined by Member A (Access blocked)')
+  ->checkDispatch('community', 'joinlist')
+  ->isStatusCode(404)
+->get('/community/joinList?id=2')
+  ->info('4-2. Member E can view the list of communities joined by Member B (Normal behavior)')
+  ->checkDispatch('community', 'joinlist')
+  ->isStatusCode(200)
+  ->with('response')
+    ->checkElement('#communityList tr.text a', 5) // 5 communities
+;
+
 $user->login('[email protected]', 'password');
 $user
   ->info('community/search')