From 318efa80932f1d24c8a6ce1c2b7510df4023bc81 Mon Sep 17 00:00:00 2001 From: Bianca Nenciu Date: Mon, 5 Oct 2020 19:38:08 +0300 Subject: [PATCH] FIX: Always let moderators to see their group PMs (#10813) When enable_personal_messages was disabled, moderators could not see the private messages for the "moderators" group. The link was displayed on the client side, but the checks on the server side did not allow it. --- lib/guardian/group_guardian.rb | 1 + spec/requests/list_controller_spec.rb | 11 +++++++++++ 2 files changed, 12 insertions(+) diff --git a/lib/guardian/group_guardian.rb b/lib/guardian/group_guardian.rb index 7246f6c5e17..7aa0f9ebfcc 100644 --- a/lib/guardian/group_guardian.rb +++ b/lib/guardian/group_guardian.rb @@ -35,6 +35,7 @@ module GroupGuardian def can_see_group_messages?(group) return true if is_admin? + return true if is_moderator? && group.id == Group::AUTO_GROUPS[:moderators] SiteSetting.enable_personal_messages? && group.users.include?(user) end diff --git a/spec/requests/list_controller_spec.rb b/spec/requests/list_controller_spec.rb index 1bcab4542d7..954765e46fc 100644 --- a/spec/requests/list_controller_spec.rb +++ b/spec/requests/list_controller_spec.rb @@ -197,6 +197,17 @@ RSpec.describe ListController do .to eq(topic.id) end + it 'should display moderator group private messages for a moderator' do + moderator = Fabricate(:moderator) + group = Group.find(Group::AUTO_GROUPS[:moderators]) + topic = Fabricate(:private_message_topic, allowed_groups: [group]) + + sign_in(moderator) + + get "/topics/private-messages-group/#{moderator.username}/#{group.name}.json" + expect(response.status).to eq(200) + end + it "should not display group private messages for a moderator's group" do moderator = Fabricate(:moderator) sign_in(moderator)