From 3a45ebc71613174392b0d4d541df71dc13b18e20 Mon Sep 17 00:00:00 2001 From: IanM <16573496+imorland@users.noreply.github.com> Date: Tue, 15 Oct 2024 12:10:55 +0100 Subject: [PATCH] [1.x] [suspend] fix: previously suspended admin users cannot remove their avatar after suspension (#4071) * [1.x][suspend] fix: formally suspended admin users cannot remove their avatar after suspension * Apply fixes from StyleCI --------- Co-authored-by: StyleCI Bot --- .../src/Listener/PreventAvatarDeletionBySuspendedUser.php | 2 +- .../tests/integration/api/users/RemoveAvatarTest.php | 7 ++++++- 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/extensions/suspend/src/Listener/PreventAvatarDeletionBySuspendedUser.php b/extensions/suspend/src/Listener/PreventAvatarDeletionBySuspendedUser.php index 9f5e519985..8044e718ff 100644 --- a/extensions/suspend/src/Listener/PreventAvatarDeletionBySuspendedUser.php +++ b/extensions/suspend/src/Listener/PreventAvatarDeletionBySuspendedUser.php @@ -18,7 +18,7 @@ public function handle($event) $actor = $event->actor; $user = $event->user; - if ($actor->id === $user->id && $user->suspended_until) { + if (! $actor->isAdmin() && $actor->id === $user->id && $user->suspended_until && $user->suspended_until->isFuture()) { throw new PermissionDeniedException(); } } diff --git a/extensions/suspend/tests/integration/api/users/RemoveAvatarTest.php b/extensions/suspend/tests/integration/api/users/RemoveAvatarTest.php index 44b5cfbbe9..3954b168ab 100644 --- a/extensions/suspend/tests/integration/api/users/RemoveAvatarTest.php +++ b/extensions/suspend/tests/integration/api/users/RemoveAvatarTest.php @@ -31,12 +31,14 @@ public function setUp(): void ['id' => 3, 'username' => 'acme', 'email' => 'acme@machine.local', 'is_email_confirmed' => 1, 'suspended_until' => Carbon::now()->addDay(), 'suspend_message' => 'You have been suspended.', 'suspend_reason' => 'Suspended for acme reasons.'], ['id' => 4, 'username' => 'acme4', 'email' => 'acme4@machine.local', 'is_email_confirmed' => 1], ['id' => 5, 'username' => 'acme5', 'email' => 'acme5@machine.local', 'is_email_confirmed' => 1, 'suspended_until' => Carbon::now()->subDay(), 'suspend_message' => 'You have been suspended.', 'suspend_reason' => 'Suspended for acme reasons.'], + ['id' => 6, 'username' => 'acme6', 'email' => 'acme6@machine.local', 'is_email_confirmed' => 1, 'suspended_until' => Carbon::now()->subWeek(), 'suspend_message' => 'You have been suspended.', 'suspend_reason' => 'Suspended for acme reasons.'], ], 'groups' => [ ['id' => 5, 'name_singular' => 'can_edit_users', 'name_plural' => 'can_edit_users', 'is_hidden' => 0] ], 'group_user' => [ - ['user_id' => 2, 'group_id' => 5] + ['user_id' => 2, 'group_id' => 5], + ['user_id' => 6, 'group_id' => 1], ], 'group_permission' => [ ['permission' => 'user.edit', 'group_id' => 5], @@ -73,6 +75,9 @@ public function allowedToRemoveAvatar(): array [4, 4, 'Normal user can remove their own avatar'], [1, 3, 'Admin can remove avatar of suspended user'], [2, 3, 'Normal user with permission can remove avatar of suspended user'], + [1, 6, 'Admin can remove avatar of expired suspended user'], + [2, 6, 'Normal user with permission can remove avatar of expired suspended user'], + [6, 6, 'Admin user can remove avatar if they have an expired suspension'], ]; }