Merge branch '2' into 3.1

silverstripe · Nov 13, 2023 · 018618d · 018618d
2 parents d409bce + e12e2aa
commit 018618d
Show file tree

Hide file tree

Showing 4 changed files with 38 additions and 13 deletions.
diff --git a/client/dist/js/BrokenExternalLinksReport.js b/client/dist/js/BrokenExternalLinksReport.js
diff --git a/client/src/js/BrokenExternalLinksReport.js b/client/src/js/BrokenExternalLinksReport.js
@@ -34,11 +34,8 @@
             self.setReloadContent(true);
             self.poll();
           },
-          error(e) {
-            if (typeof console !== 'undefined') {
-              // eslint-disable-next-line no-console
-              console.error(e);
-            }
+          error() {
+            self.buttonReset();
           }
         });
       },
@@ -141,11 +138,7 @@
               $('.external-links-report__create-report').poll();
             }, 1000));
           },
-          error(e) {
-            if (typeof console !== 'undefined') {
-              // eslint-disable-next-line no-console
-              console.error(e);
-            }
+          error() {
             self.buttonReset();
           }
         });

diff --git a/src/Controllers/CMSExternalLinksController.php b/src/Controllers/CMSExternalLinksController.php
@@ -8,6 +8,7 @@
 use SilverStripe\Control\Controller;
 use Symbiote\QueuedJobs\Services\QueuedJobService;
 use SilverStripe\Control\Middleware\HTTPCacheControlMiddleware;
+use SilverStripe\Security\Permission;
 
 class CMSExternalLinksController extends Controller
 {
@@ -24,6 +25,9 @@ class CMSExternalLinksController extends Controller
      */
     public function getJobStatus()
     {
+        if (!Permission::check('CMS_ACCESS_CMSMain')) {
+            return $this->httpError(403, 'You do not have permission to access this resource');
+        }
         // Set headers
         HTTPCacheControlMiddleware::singleton()->setMaxAge(0);
         $this->response
@@ -49,6 +53,9 @@ public function getJobStatus()
      */
     public function start()
     {
+        if (!Permission::check('CMS_ACCESS_CMSMain')) {
+            return $this->httpError(403, 'You do not have permission to access this resource');
+        }
         // return if the a job is already running
         $status = BrokenExternalPageTrackStatus::get_latest();
         if ($status && $status->Status == 'Running') {

diff --git a/tests/php/ExternalLinksTest.php b/tests/php/ExternalLinksTest.php
@@ -3,7 +3,7 @@
 namespace SilverStripe\ExternalLinks\Tests;
 
 use SilverStripe\Core\Injector\Injector;
-use SilverStripe\Dev\SapphireTest;
+use SilverStripe\Dev\FunctionalTest;
 use SilverStripe\ExternalLinks\Model\BrokenExternalPageTrackStatus;
 use SilverStripe\ExternalLinks\Reports\BrokenExternalLinksReport;
 use SilverStripe\ExternalLinks\Tasks\CheckExternalLinksTask;
@@ -13,7 +13,7 @@
 use SilverStripe\i18n\i18n;
 use SilverStripe\Reports\Report;
 
-class ExternalLinksTest extends SapphireTest
+class ExternalLinksTest extends FunctionalTest
 {
 
     protected static $fixture_file = 'ExternalLinksTest.yml';
@@ -125,4 +125,29 @@ public function testArchivedPagesAreHiddenFromReport()
         // Ensure report does not list the link associated with an archived page
         $this->assertEquals(3, BrokenExternalLinksReport::create()->sourceRecords()->count());
     }
+
+    public function provideGetJobStatus(): array
+    {
+        return [
+            'ADMIN - valid permission' => ['ADMIN', 200],
+            'CMS_ACCESS_CMSMain - valid permission' => ['CMS_ACCESS_CMSMain', 200],
+            'VIEW_SITE - not enough permission' => ['VIEW_SITE', 403],
+        ];
+    }
+
+    /**
+     * @dataProvider provideGetJobStatus
+     */
+    public function testGetJobStatus(
+        string $permission,
+        int $expectedResponseCode
+    ): void {
+        $this->logInWithPermission($permission);
+
+        $response = $this->get('admin/externallinks/start', null, ['Accept' => 'application/json']);
+        $this->assertEquals($expectedResponseCode, $response->getStatusCode());
+
+        $response = $this->get('admin/externallinks/getJobStatus', null, ['Accept' => 'application/json']);
+        $this->assertEquals($expectedResponseCode, $response->getStatusCode());
+    }
 }