From e5c1a2d7bada63a461f7330198f0920ecd48bb9d Mon Sep 17 00:00:00 2001 From: Duke Greene Date: Tue, 8 Aug 2023 09:53:33 -0400 Subject: [PATCH] prevent replies to a blocking user on a third party's article (#19898) --- app/controllers/comments_controller.rb | 3 ++- spec/requests/comments_create_spec.rb | 19 +++++++++++++++++++ 2 files changed, 21 insertions(+), 1 deletion(-) diff --git a/app/controllers/comments_controller.rb b/app/controllers/comments_controller.rb index 355dfbc94..1167c4ed9 100644 --- a/app/controllers/comments_controller.rb +++ b/app/controllers/comments_controller.rb @@ -314,6 +314,7 @@ class CommentsController < ApplicationController def user_blocked? return false if current_user.blocked_by_count.zero? - UserBlock.blocking?(@comment.commentable.user_id, current_user.id) + UserBlock.blocking?(@comment.commentable.user_id, current_user.id) || + UserBlock.blocking?(@comment.parent&.user_id, current_user.id) end end diff --git a/spec/requests/comments_create_spec.rb b/spec/requests/comments_create_spec.rb index a02031ba0..ad75f11a5 100644 --- a/spec/requests/comments_create_spec.rb +++ b/spec/requests/comments_create_spec.rb @@ -88,6 +88,25 @@ RSpec.describe "CommentsCreate" do end end + context "when user is commenting on a comment by an author who has blocked the user" do + let(:third_party_article) { create(:article, user_id: create(:user).id) } + + it "raises a ModerationUnauthorizedError to prevent the comment from saving" do + create(:user_block, blocker: blocker, blocked: user, config: "default") + # Manually manage the blocked_by_count attribute that counter_culture manages in prod + user.update(blocked_by_count: 1) + blocker_comment = create(:comment, user_id: blocker.id, + commentable_id: third_party_article.id, + commentable_type: "Article") + expect do + post comments_path, params: comment_params(body_markdown: "trolling attempted!", + parent_id: blocker_comment.id) + expect(response).to have_http_status(:unprocessable_entity) + expect(response.parsed_body["error"]).to eq("Not allowed due to moderation action") + end.not_to change(Comment, :count) + end + end + context "when an error is raised before authorization is performed" do before do allow(RateLimitChecker).to receive(:new).and_return(rate_limit_checker)