vassili/seitime-frappe
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

Merge pull request #38952 from AarDG10/fix-disc-topic

Browse source 
fix(discussion_topic): add perm. check to submit_discussion method
This commit is contained in:
Aarol D'Souza 2026-04-28 16:18:17 +05:30 • committed by GitHub
commit 9d683f15c7
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 18 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
frappe/website/doctype/discussion_topic/discussion_topic.py
View file

@ -33,6 +33,8 @@ def submit_discussion(
):
if reply_name:
doc = frappe.get_doc("Discussion Reply", reply_name)
if doc.owner != frappe.session.user:
frappe.throw(frappe._("You can only edit your own replies."), frappe.PermissionError)
doc.reply = reply
doc.save(ignore_permissions=True)
return

18
frappe/website/doctype/discussion_topic/test_discussion_topic.py
View file

@ -1,9 +1,23 @@
# Copyright (c) 2021, FOSS United and Contributors
# See license.txt
# import frappe
import frappe
from frappe.tests import IntegrationTestCase
from frappe.website.doctype.discussion_topic.discussion_topic import submit_discussion
class TestDiscussionTopic(IntegrationTestCase):
pass
def test_edit_discussion_reply(self):
"""Test whether editing a reply is restricted to the owner."""
topic_name = submit_discussion("User", "Administrator", "Original", "Title")
reply_name = frappe.db.get_value("Discussion Reply", {"topic": topic_name}, "name")
frappe.set_user("Guest")
with self.assertRaises(frappe.PermissionError):
submit_discussion("User", "Administrator", "Hacked", "Title", reply_name=reply_name)
self.assertEqual(frappe.db.get_value("Discussion Reply", reply_name, "reply"), "Original")
frappe.set_user("Administrator")
submit_discussion("User", "Administrator", "Changed!", "Title", reply_name=reply_name)
self.assertEqual(frappe.db.get_value("Discussion Reply", reply_name, "reply"), "Changed!")