tim/xxx
1
0
Fork 0
Code Issues Pull Requests Releases Activity

Load a saved story into the form for editors only.

Browse Source 
Visitors could post an id to /publish and read the author's email address.
This commit is contained in:
tim
2026-09-26 15:27:51 +02:00
parent 8f4851e576
commit bf36ec25fd
2 changed files with 13 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
publish/write.inc.php
+2 -1
View File
@@ -4,7 +4,8 @@ $search = get_search_args();
if ($action == 'preview')
$result = get_post_data(TRUE);
else if ($action && is_numeric($id))
// Only editors load a saved story; it holds the author's email address
else if ($is_admin && $action && is_numeric($id))
$result = get_query($id);
if (isset($result) && is_array($result))
extract($result[0], EXTR_OVERWRITE);
tests/php/Pages/SubmitTest.php
+11
View File
@@ -97,6 +97,17 @@ class SubmitTest extends PageTestCase {
$this->assertSame(array('original author', 0, ''), array($tables['queue'][0]['editor'], $tables['queue'][0]['hidden'], $tables['queue'][0]['comments']));
}
public function testVisitorsCannotLoadAStoryIntoTheForm(): void {
$this->setTables(array('xxx' => array(array('id' => 7, 'title' => 'Live one', 'email' => 'author@example.org'))));
$token = $this->csrfToken($this->get('/publish')['body']);
foreach (array('edit', 'choose', 'other') as $action) {
$page = $this->post('/publish', array('action' => $action, 'id' => '7', 'csrf_token' => $token));
$this->assertStringNotContainsString('author@example.org', $page['body']);
$this->assertStringNotContainsString('Live one', $page['body']);
}
$this->assertSame(array(), $this->queries('/^SELECT \* FROM xxx/'));
}
public function testAPostWithoutTheTokenOnlyGetsAPreview(): void {
$this->get('/publish');
$page = $this->post('/publish', $this->story(array('action' => 'submit', 'csrf_token' => 'wrong', 'g-recaptcha-response' => 'pass')));