From ad0f530fd3c68b7b8d53b02c68575f5394494c3e Mon Sep 17 00:00:00 2001 From: Riley Davis Date: Thu, 12 Jan 2017 17:07:35 -0700 Subject: [PATCH 1/5] don't return unpublished comments in My Comments section. add tests --- models/comment.js | 12 ++++++++++-- routes/api/comments/index.js | 2 +- tests/models/comment.js | 17 +++++++++++++++++ tests/routes/api/comments/index.js | 5 ++--- 4 files changed, 30 insertions(+), 6 deletions(-) diff --git a/models/comment.js b/models/comment.js index 9bd9163c4..d99cbed06 100644 --- a/models/comment.js +++ b/models/comment.js @@ -282,8 +282,16 @@ CommentSchema.statics.all = () => Comment.find(); * probably to be paginated at some point in the future * @return {Promise} array resolves to an array of comments by that user */ -CommentSchema.statics.findByUserId = function (author_id) { - return Comment.find({author_id}); +CommentSchema.statics.findByUserId = function (author_id, admin = false) { + + // do not return un-published comments for non-admins + let query = {author_id}; + + if (!admin) { + query.$nor = [{status: 'premod'}, {status: 'rejected'}]; + } + + return Comment.find(query); }; // Comment model. diff --git a/routes/api/comments/index.js b/routes/api/comments/index.js index 8bf3616eb..1d5d73ea0 100644 --- a/routes/api/comments/index.js +++ b/routes/api/comments/index.js @@ -48,7 +48,7 @@ router.get('/', (req, res, next) => { // otherwise this will be a vulnerability if you pass user_id and something else, // the app will return admin-level data without the proper checks if (user_id) { - query = Comment.findByUserId(user_id); + query = Comment.findByUserId(user_id, authorization.has(req.user, 'admin')); } else if (status) { query = assetIDWrap(Comment.findByStatus(status === 'new' ? null : status)); } else if (action_type) { diff --git a/tests/models/comment.js b/tests/models/comment.js index 20590dc3d..419fb4d79 100644 --- a/tests/models/comment.js +++ b/tests/models/comment.js @@ -209,6 +209,23 @@ describe('models.Comment', () => { }); }); + describe('#findByUserId', () => { + it('should return all comments if admin', () => { + return Comment.findByUserId('456', true) + .then(comments => { + expect(comments).to.have.length(4); + }); + }); + + it('should not return premod and rejected comments if not admin', () => { + return Comment.findByUserId('456') + .then(comments => { + expect(comments).to.have.length(1); + }); + }); + + }); + describe('#changeStatus', () => { it('should change the status of a comment from no status', () => { diff --git a/tests/routes/api/comments/index.js b/tests/routes/api/comments/index.js index 5edb52099..ed1f3d22f 100644 --- a/tests/routes/api/comments/index.js +++ b/tests/routes/api/comments/index.js @@ -83,15 +83,14 @@ describe('/api/v1/comments', () => { ]); }); - it('should return only the owner’s comments if the user is not an admin', () => { + it('should return only the owner’s published comments if the user is not an admin', () => { return chai.request(app) .get('/api/v1/comments?user_id=456') .set(passport.inject({id: '456', roles: []})) .then(res => { expect(res).to.have.status(200); - expect(res.body.comments).to.have.length(2); + expect(res.body.comments).to.have.length(1); expect(res.body.comments[0]).to.have.property('author_id', '456'); - expect(res.body.comments[1]).to.have.property('author_id', '456'); }); }); From f56e30c1a1ab2c42728ce10f5e9b1cea1891112e Mon Sep 17 00:00:00 2001 From: David Erwin Date: Fri, 13 Jan 2017 10:08:35 -0500 Subject: [PATCH 2/5] Updating docs for .env functionality --- README.md | 30 ++++++++++++++++-------------- 1 file changed, 16 insertions(+), 14 deletions(-) diff --git a/README.md b/README.md index 239483628..6b5105a54 100644 --- a/README.md +++ b/README.md @@ -17,30 +17,32 @@ To launch a Talk server of your own from your browser without any need to muck a ### Configuration -The Talk application requires specific configuration options to be available -inside the environment in order to run, those variables are listed here: +The Talk application looks for the following configuration values either as +environment variables or via an `.env` file: - `TALK_MONGO_URL` (*required*) - the database connection string for the MongoDB database. - `TALK_REDIS_URL` (*required*) - the database connection string for the Redis database. - `TALK_SESSION_SECRET` (*required*) - a random string which will be used to secure cookies. -- `TALK_FACEBOOK_APP_ID` (*required*) - the Facebook app id for your Facebook -Login enabled app. -- `TALK_FACEBOOK_APP_SECRET` (*required*) - the Facebook app secret for your -Facebook Login enabled app. - `TALK_ROOT_URL` (*required*) - root url of the installed application externally available in the format: `://` without the path. -- `TALK_SMTP_EMAIL` (*required*) - the address to send emails from using the + +- `TALK_FACEBOOK_APP_ID` (*required for login via fb*) - the Facebook app id for your Facebook +Login enabled app. +- `TALK_FACEBOOK_APP_SECRET` (*required for login via fb*) - the Facebook app secret for your +Facebook Login enabled app. + +- `TALK_SMTP_EMAIL` (*required for email*) - the address to send emails from using the SMTP provider. -- `TALK_SMTP_USERNAME` (*required*) - username of the SMTP provider you are using. -- `TALK_SMTP_PASSWORD` (*required*) - password for the SMTP provider you are using. -- `TALK_SMTP_HOST` (*required*) - SMTP host url with format `smtp.domain.com`. -- `TALK_SMTP_PORT` (*required*) - SMTP port. +- `TALK_SMTP_USERNAME` (*required for email*) - username of the SMTP provider you are using. +- `TALK_SMTP_PASSWORD` (*required for email*) - password for the SMTP provider you are using. +- `TALK_SMTP_HOST` (*required for email*) - SMTP host url with format `smtp.domain.com`. +- `TALK_SMTP_PORT` (*required for email*) - SMTP port. +We recommend using environment variables for configuration in staging and +production environments. -### Install from Source - -If you want to run Talk in development mode from source (without docker) you can read the [INSTALL file](INSTALL.md). +For more information about configuration via `.env`, please [visit our wiki](https://github.com/coralproject/talk/wiki/Configuration-via-.env). ### License From 7c95781072efb77fc9b5a86dd1f70b76f0984899 Mon Sep 17 00:00:00 2001 From: David Erwin Date: Fri, 13 Jan 2017 10:21:12 -0500 Subject: [PATCH 3/5] Update README.md --- README.md | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/README.md b/README.md index 6b5105a54..e005c314f 100644 --- a/README.md +++ b/README.md @@ -17,8 +17,7 @@ To launch a Talk server of your own from your browser without any need to muck a ### Configuration -The Talk application looks for the following configuration values either as -environment variables or via an `.env` file: +The Talk application looks for the following configuration values either as environment variables: - `TALK_MONGO_URL` (*required*) - the database connection string for the MongoDB database. - `TALK_REDIS_URL` (*required*) - the database connection string for the Redis database. @@ -39,10 +38,7 @@ Facebook Login enabled app. - `TALK_SMTP_HOST` (*required for email*) - SMTP host url with format `smtp.domain.com`. - `TALK_SMTP_PORT` (*required for email*) - SMTP port. -We recommend using environment variables for configuration in staging and -production environments. - -For more information about configuration via `.env`, please [visit our wiki](https://github.com/coralproject/talk/wiki/Configuration-via-.env). +During development mode, you can use the command `npm run dev-start` which will load environment variables from a file named .env in the present working directory. ### License From 39a4d031c71c989940419f8299bd1706c8cc0874 Mon Sep 17 00:00:00 2001 From: Wyatt Johnson Date: Fri, 13 Jan 2017 08:24:12 -0700 Subject: [PATCH 4/5] Adjusted for new wiki page --- README.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index e005c314f..79c523925 100644 --- a/README.md +++ b/README.md @@ -38,7 +38,8 @@ Facebook Login enabled app. - `TALK_SMTP_HOST` (*required for email*) - SMTP host url with format `smtp.domain.com`. - `TALK_SMTP_PORT` (*required for email*) - SMTP port. -During development mode, you can use the command `npm run dev-start` which will load environment variables from a file named .env in the present working directory. +Refer to the wiki page on [Configuration Loading](https://github.com/coralproject/talk/wiki/Configuration-Loading) for +alternative methods of loading configuration during development. ### License From 44a06aef46c41f11ccb4251adb426d31c23a5241 Mon Sep 17 00:00:00 2001 From: Riley Davis Date: Fri, 13 Jan 2017 14:33:01 -0700 Subject: [PATCH 5/5] do not render tab content unless they're active --- client/coral-admin/src/actions/comments.js | 6 +- .../ModerationQueue/ModerationQueue.js | 90 +++++++++++-------- 2 files changed, 54 insertions(+), 42 deletions(-) diff --git a/client/coral-admin/src/actions/comments.js b/client/coral-admin/src/actions/comments.js index f37c79b4f..fe4895ed3 100644 --- a/client/coral-admin/src/actions/comments.js +++ b/client/coral-admin/src/actions/comments.js @@ -55,9 +55,9 @@ export const fetchFlaggedQueue = () => { dispatch({type: commentTypes.COMMENTS_MODERATION_QUEUE_FETCH_REQUEST}); return coralApi('/queue/comments/flagged') - .then(comments => { - comments.forEach(comment => comment.flagged = true); - return comments; + .then(results => { + results.comments.forEach(comment => comment.flagged = true); + return results; }) .then(addUsersCommentsActions.bind(this, dispatch)); }; diff --git a/client/coral-admin/src/containers/ModerationQueue/ModerationQueue.js b/client/coral-admin/src/containers/ModerationQueue/ModerationQueue.js index d46a9b35d..6121ca307 100644 --- a/client/coral-admin/src/containers/ModerationQueue/ModerationQueue.js +++ b/client/coral-admin/src/containers/ModerationQueue/ModerationQueue.js @@ -22,49 +22,61 @@ export default ({onTabClick, ...props}) => ( className={`mdl-tabs__tab ${styles.tab}`}>{lang.t('modqueue.flagged')}
- - + { + props.activeTab === 'pending' + ?
+ + +
+ : null + }
- + { + props.activeTab === 'rejected' + ? + : null + }
- -
+ { + props.activeTab === 'flagged' + ? + : null + } +