starred/BookStack
1
0
Fork 0
mirror of https://github.com/BookStackApp/BookStack.git synced 2026-05-04 18:08:46 +03:00
Code Issues 784 Packages Projects Releases 15 Wiki Activity

Permissions: Prevent export revision metadata view without permission

Browse Source
This commit is contained in:
Dan Brown
2026-04-19 16:23:16 +01:00
parent ec0b0384a2
commit 426f9ac493
2 changed files with 16 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
resources/views/exports/parts/meta.blade.php
View File

@@ -1,5 +1,5 @@
<div class="entity-meta">
@if ($entity->isA('page'))
@if ($entity->isA('page') && userCan(\BookStack\Permissions\Permission::RevisionViewAll))
@icon('history'){{ trans('entities.meta_revision', ['revisionCount' => $entity->revision_count]) }} <br>
@endif

15
tests/Exports/HtmlExportTest.php
View File

@@ -5,6 +5,7 @@ namespace Tests\Exports;
use BookStack\Entities\Models\Book;
use BookStack\Entities\Models\Chapter;
use BookStack\Entities\Models\Page;
use BookStack\Permissions\Permission;
use Illuminate\Support\Facades\Storage;
use Tests\TestCase;
@@ -229,6 +230,20 @@ class HtmlExportTest extends TestCase
$resp->assertDontSee('ExportWizardTheFifth');
}
public function test_page_export_only_includes_revision_count_if_user_has_revision_view_permissions()
{
$editor = $this->users->editor();
$page = $this->entities->page();
$resp = $this->actingAs($editor)->get($page->getUrl('/export/html'));
$resp->assertSee('Revision #');
$this->permissions->removeUserRolePermissions($editor, [Permission::RevisionViewAll]);
$resp = $this->actingAs($editor)->get($page->getUrl('/export/html'));
$resp->assertDontSee('Revision #');
}
public function test_html_exports_contain_csp_meta_tag()
{
$entities = [