diff options
| -rw-r--r-- | CHANGELOG.md | 1 | ||||
| -rw-r--r-- | perllib/FixMyStreet/App/Controller/JSON.pm | 1 | ||||
| -rw-r--r-- | perllib/FixMyStreet/App/Controller/Open311.pm | 4 | ||||
| -rw-r--r-- | t/app/controller/open311.t | 41 |
4 files changed, 45 insertions, 2 deletions
diff --git a/CHANGELOG.md b/CHANGELOG.md index 53a580b11..40e554cc3 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -39,6 +39,7 @@ - Stop category_change firing more than it should. - Fix extra question display when only one category. - Fix superusers creating anonymous reports. #2435 + - Ensure non_public reports aren't exposed at /open311 endpoint. - Development improvements: - Make front page cache time configurable. - Better working of /fakemapit/ under https. diff --git a/perllib/FixMyStreet/App/Controller/JSON.pm b/perllib/FixMyStreet/App/Controller/JSON.pm index e1e135054..ccc5b31dc 100644 --- a/perllib/FixMyStreet/App/Controller/JSON.pm +++ b/perllib/FixMyStreet/App/Controller/JSON.pm @@ -87,6 +87,7 @@ sub problems : Local { my $query = { $date_col => $range->sql, state => [ @state ], + non_public => 0, }; $query->{category} = $category if $category; my @problems = $c->cobrand->problems->search( $query, { diff --git a/perllib/FixMyStreet/App/Controller/Open311.pm b/perllib/FixMyStreet/App/Controller/Open311.pm index 97e1a782a..841330e92 100644 --- a/perllib/FixMyStreet/App/Controller/Open311.pm +++ b/perllib/FixMyStreet/App/Controller/Open311.pm @@ -309,7 +309,8 @@ sub get_requests : Private { delete $states->{unconfirmed}; delete $states->{submitted}; my $criteria = { - state => [ keys %$states ] + state => [ keys %$states ], + non_public => 0, }; my %rules = ( @@ -414,6 +415,7 @@ sub get_request : Private { my $criteria = { state => [ keys %$states ], id => $id, + non_public => 0, }; $c->forward( 'output_requests', [ $criteria ] ); } diff --git a/t/app/controller/open311.t b/t/app/controller/open311.t index 9f4f594fe..79fe159a3 100644 --- a/t/app/controller/open311.t +++ b/t/app/controller/open311.t @@ -6,7 +6,7 @@ my $mech = FixMyStreet::TestMech->new; $mech->get_ok('/open311.cgi/v2/requests.rss?jurisdiction_id=fiksgatami.no&status=open&agency_responsible=1854'); like $mech->uri, qr[/open311/v2/requests\.rss\?.{65}]; # Don't know order parameters will be in now -$mech->create_problems_for_body(2, 2237, 'Around page'); +my ($problem1, $problem2) = $mech->create_problems_for_body(2, 2237, 'Around page'); $mech->get_ok('/open311/v2/requests.xml?jurisdiction_id=foo&status=open&agency_responsible=2237'); $mech->content_contains('<description>Around page Test 2 for 2237: Around page Test 2 for 2237 Detail</description>'); $mech->content_contains('<interface_used>Web interface</interface_used>'); @@ -18,4 +18,43 @@ my $problems = $json->{requests}[0]{request}; is @$problems, 2; like $problems->[0]{description}, qr/Around page Test/; +subtest "non_public reports aren't available" => sub { + $problem1->update({ + non_public => 1, + detail => 'This report is now private', + }); + $mech->get_ok('/open311/v2/requests.json?jurisdiction_id=foo'); + $json = decode_json($mech->content); + $problems = $json->{requests}[0]{request}; + is @$problems, 1; + like $problems->[0]{description}, qr/Around page Test/; + $mech->content_lacks('This report is now private'); + + my $problem_id = $problem1->id; + $mech->get_ok("/open311/v2/requests/$problem_id.json?jurisdiction_id=foo"); + $json = decode_json($mech->content); + $problems = $json->{requests}[0]{request}; + is @$problems, 0; +}; + +subtest "hidden reports aren't available" => sub { + $problem1->update({ + non_public => 0, + detail => 'This report is now hidden', + state => "hidden", + }); + $mech->get_ok('/open311/v2/requests.json?jurisdiction_id=foo'); + $json = decode_json($mech->content); + $problems = $json->{requests}[0]{request}; + is @$problems, 1; + like $problems->[0]{description}, qr/Around page Test/; + $mech->content_lacks('This report is now hidden'); + + my $problem_id = $problem1->id; + $mech->get_ok("/open311/v2/requests/$problem_id.json?jurisdiction_id=foo"); + $json = decode_json($mech->content); + $problems = $json->{requests}[0]{request}; + is @$problems, 0; +}; + done_testing(); |