self-hosted/focalboard
1
0
Fork 0
mirror of https://github.com/mattermost/focalboard.git synced 2025-10-31 00:17:42 +02:00
Code Issues Releases Activity

Fix public boards setting not applying properly (#4739)

Browse Source
This commit is contained in:
Scott Bishel
2023-05-11 08:06:06 -06:00
committed by GitHub
parent 0af70a0a4f
commit d10e4070ba
2 changed files with 33 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
server/auth/auth.go
View File

@@ -54,6 +54,10 @@ func (a *Auth) IsValidReadToken(boardID string, readToken string) (bool, error)
return false, err
}
if !a.config.EnablePublicSharedBoards {
return false, errors.New("public shared boards disabled")
}
if sharing != nil && (sharing.ID == boardID && sharing.Enabled && sharing.Token == readToken) {
return true, nil
}

29
server/integrationtests/permissions_test.go
View File

@@ -581,6 +581,35 @@ func TestPermissionsGetBoard(t *testing.T) {
})
}
func TestPermissionsGetBoardPublic(t *testing.T) {
ttCases := []TestCase{
{"/boards/{PRIVATE_BOARD_ID}?read_token=invalid", methodGet, "", userAnon, http.StatusUnauthorized, 0},
{"/boards/{PRIVATE_BOARD_ID}?read_token=valid", methodGet, "", userAnon, http.StatusUnauthorized, 1},
{"/boards/{PRIVATE_BOARD_ID}?read_token=invalid", methodGet, "", userNoTeamMember, http.StatusForbidden, 0},
{"/boards/{PRIVATE_BOARD_ID}?read_token=valid", methodGet, "", userTeamMember, http.StatusForbidden, 1},
}
t.Run("plugin", func(t *testing.T) {
th := SetupTestHelperPluginMode(t)
defer th.TearDown()
cfg := th.Server.Config()
cfg.EnablePublicSharedBoards = false
th.Server.UpdateAppConfig()
clients := setupClients(th)
testData := setupData(t, th)
runTestCases(t, ttCases, testData, clients)
})
t.Run("local", func(t *testing.T) {
th := SetupTestHelperLocalMode(t)
defer th.TearDown()
cfg := th.Server.Config()
cfg.EnablePublicSharedBoards = false
th.Server.UpdateAppConfig()
clients := setupLocalClients(th)
testData := setupData(t, th)
runTestCases(t, ttCases, testData, clients)
})
}
func TestPermissionsPatchBoard(t *testing.T) {
ttCases := []TestCase{
{"/boards/{PRIVATE_BOARD_ID}", methodPatch, "{\"title\": \"test\"}", userAnon, http.StatusUnauthorized, 0},