Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

FIX Renable email link to submitted file #1236

Merged
merged 1 commit into from
Sep 5, 2023
Merged

FIX Renable email link to submitted file #1236

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
39 changes: 27 additions & 12 deletions code/Model/Submission/SubmittedFileField.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,8 @@
use SilverStripe\Control\Director;
use SilverStripe\ORM\FieldType\DBField;
use SilverStripe\Versioned\Versioned;
use SilverStripe\Security\Member;
use SilverStripe\Security\Security;

/**
* A file uploaded on a {@link UserDefinedForm} and attached to a single
Expand Down Expand Up @@ -41,27 +43,40 @@ public function getFormattedValue()
{
$name = $this->getFileName();
$link = $this->getLink(false);
$title = _t(__CLASS__ . '.DOWNLOADFILE', 'Download File');
$message = _t(__CLASS__ . '.INSUFFICIENTRIGHTS', 'You don\'t have the right permissions to download this file');
$file = $this->getUploadedFileFromDraft();

if ($link) {
if ($file->canView()) {
$title = _t(__CLASS__ . '.DOWNLOADFILE', 'Download File');
$file = $this->getUploadedFileFromDraft();
if (!$file->canView()) {
if (Security::getCurrentUser()) {
// Logged in CMS user without permissions to view file in the CMS
$default = 'You don\'t have the right permissions to download this file';
$message = _t(__CLASS__ . '..INSUFFICIENTRIGHTS', $default);
return DBField::create_field('HTMLText', sprintf(
'<i class="icon font-icon-lock"></i> %s - <em>%s</em>',
htmlspecialchars($name, ENT_QUOTES),
htmlspecialchars($message, ENT_QUOTES)
));
} else {
// Userforms submission filled in by non-logged in user being emailed to recipient
$message = _t(__CLASS__ . '.YOUMUSTBELOGGEDIN', 'You must be logged in to view this file');
return DBField::create_field('HTMLText', sprintf(
'%s - <a href="%s" target="_blank">%s</a> - <em>%s</em>',
htmlspecialchars($name, ENT_QUOTES),
htmlspecialchars($link, ENT_QUOTES),
htmlspecialchars($title, ENT_QUOTES),
htmlspecialchars($message, ENT_QUOTES)
));
}
} else {
// Logged in CMS user with permissions to view file in the CMS
return DBField::create_field('HTMLText', sprintf(
'%s - <a href="%s" target="_blank">%s</a>',
htmlspecialchars($name, ENT_QUOTES),
htmlspecialchars($link, ENT_QUOTES),
htmlspecialchars($title, ENT_QUOTES)
));
} else {
return DBField::create_field('HTMLText', sprintf(
'<i class="icon font-icon-lock"></i> %s - <em>%s</em>',
htmlspecialchars($name, ENT_QUOTES),
htmlspecialchars($message, ENT_QUOTES)
));
}
}

return false;
}

Expand Down
1 change: 1 addition & 0 deletions lang/en.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -328,6 +328,7 @@ en:
one: 'A Submitted File Field'
other: '{count} Submitted File Fields'
SINGULARNAME: 'Submitted File Field'
YOUMUSTBELOGGEDIN: 'You must be logged in to view this file'
sabina-talipova marked this conversation as resolved.
Show resolved Hide resolved
has_one_UploadedFile: 'Uploaded file'
SilverStripe\UserForms\Model\Submission\SubmittedForm:
PLURALNAME: 'Submitted Forms'
Expand Down
31 changes: 21 additions & 10 deletions tests/php/Model/SubmittedFileFieldTest.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -73,34 +73,45 @@ public function testGetFormattedValue()
// Set an explicit base URL so we get a reliable value for the test
Director::config()->set('alternate_base_url', 'http://mysite.com');
$fileName = $this->submittedFile->getFileName();
$message = "You don&#039;t have the right permissions to download this file";
$link = 'http://mysite.com/assets/3c01bdbb26/test-SubmittedFileFieldTest.txt';

$this->file->CanViewType = 'OnlyTheseUsers';
$this->file->write();

$this->loginWithPermission('ADMIN');
// Userforms submission filled in by non-logged in user being emailed to recipient
$this->logOut();
$this->assertEquals(
sprintf(
'%s - <a href="http://mysite.com/assets/3c01bdbb26/test-SubmittedFileFieldTest.txt" target="_blank">Download File</a>',
$fileName
'%s - <a href="%s" target="_blank">%s</a> - <em>%s</em>',
$fileName,
$link,
'Download File',
'You must be logged in to view this file'
),
$this->submittedFile->getFormattedValue()->value
);

$this->loginWithPermission('CMS_ACCESS_CMSMain');
// Logged in CMS user without permissions to view file in the CMS
$this->logInWithPermission('CMS_ACCESS_CMSMain');
$this->assertEquals(
sprintf(
'<i class="icon font-icon-lock"></i> %s - <em>%s</em>',
$fileName,
$message
'You don&#039;t have the right permissions to download this file'
),
$this->submittedFile->getFormattedValue()->value
);

$store = Injector::inst()->get(AssetStore::class);
$this->assertFalse(
$store->canView($fileName, $this->file->getHash()),
'Users without canView rights on the file should not have been session granted access to it'
// Logged in CMS user with permissions to view file in the CMS
$this->loginWithPermission('ADMIN');
$this->assertEquals(
sprintf(
'%s - <a href="%s" target="_blank">%s</a>',
$fileName,
$link,
'Download File'
),
$this->submittedFile->getFormattedValue()->value
);
}
}