From 681f566a66776213cb1cd0805355c3e20d85ddd5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?R=C3=A9gis=20Hanol?= Date: Mon, 1 Aug 2016 23:55:22 +0200 Subject: [PATCH] FIX: staff members should be able to see raw email of deleted posts --- app/controllers/posts_controller.rb | 2 +- spec/controllers/posts_controller_spec.rb | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/app/controllers/posts_controller.rb b/app/controllers/posts_controller.rb index 229015e1e40..1a7d6c4bf36 100644 --- a/app/controllers/posts_controller.rb +++ b/app/controllers/posts_controller.rb @@ -114,7 +114,7 @@ class PostsController < ApplicationController end def raw_email - post = Post.find(params[:id].to_i) + post = Post.unscoped.find(params[:id].to_i) guardian.ensure_can_view_raw_email!(post) render json: { raw_email: post.raw_email } end diff --git a/spec/controllers/posts_controller_spec.rb b/spec/controllers/posts_controller_spec.rb index 0f7d6c9f020..fa904ba1283 100644 --- a/spec/controllers/posts_controller_spec.rb +++ b/spec/controllers/posts_controller_spec.rb @@ -146,7 +146,7 @@ describe PostsController do describe "when logged in" do let(:user) { log_in } - let(:post) { Fabricate(:post, user: user, raw_email: 'email_content') } + let(:post) { Fabricate(:post, deleted_at: 2.hours.ago, user: user, raw_email: 'email_content') } it "raises an error if the user doesn't have permission to view raw email" do Guardian.any_instance.expects(:can_view_raw_email?).returns(false)