Merge pull request #78 from creative-commoners/pulls/2.2/fix-permissi…

…on-cmsmain FIX: CMSMain user able to see external broken links
silverstripe · May 5, 2022 · d4871e7 · d4871e7
2 parents b4ccd03 + 6d288c5
commit d4871e7
Show file tree

Hide file tree

Showing 2 changed files with 30 additions and 9 deletions.
diff --git a/src/Model/BrokenExternalLink.php b/src/Model/BrokenExternalLink.php
@@ -58,7 +58,7 @@ public function canEdit($member = false)
     public function canView($member = false)
     {
         $member = $member ? $member : Security::getCurrentUser();
-        $codes = array('content-authors', 'administrators');
+        $codes = ['CMS_ACCESS_CMSMain'];
         return Permission::checkMember($member, $codes);
     }
 

diff --git a/tests/php/Model/BrokenExternalLinkTest.php b/tests/php/Model/BrokenExternalLinkTest.php
@@ -8,21 +8,16 @@
 class BrokenExternalLinkTest extends SapphireTest
 {
     /**
-     * @param int $httpCode
-     * @param string $expected
      * @dataProvider httpCodeProvider
      */
-    public function testGetHTTPCodeDescription($httpCode, $expected)
+    public function testGetHTTPCodeDescription(int $httpCode, string $expected)
     {
         $link = new BrokenExternalLink();
         $link->HTTPCode = $httpCode;
         $this->assertSame($expected, $link->getHTTPCodeDescription());
     }
-
-    /**
-     * @return array[]
-     */
-    public function httpCodeProvider()
+
+    public function httpCodeProvider(): array
     {
         return [
             [200, '200 (OK)'],
@@ -32,4 +27,30 @@ public function httpCodeProvider()
             [789, '789 (Unknown Response Code)'],
         ];
     }
+
+    public function permissionProvider(): array
+    {
+        return [
+            ['admin', 'ADMIN'],
+            ['content-author', 'CMS_ACCESS_CMSMain'],
+            ['asset-admin', 'CMS_ACCESS_AssetAdmin'],
+        ];
+    }
+
+    /**
+     * @dataProvider permissionProvider
+     */
+    public function testCanViewReport(string $user, string $permission)
+    {
+        $this->logOut();
+        $this->logInWithPermission($permission);
+
+        $link = new BrokenExternalLink();
+
+        if ($user === 'asset-admin') {
+            $this->assertFalse($link->canView());
+        } else {
+            $this->assertTrue($link->canView());
+        }
+    }
 }