Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Do not leak all records for guest users in API controllers #2145

Merged
merged 4 commits into from
Jul 10, 2021
Merged

Do not leak all records for guest users in API controllers #2145

merged 4 commits into from
Jul 10, 2021

Commits on Jul 7, 2021

  1. Do not leak all pages for guest users in API controller 

    CanCanCan does not respect any scope set before `accessible_by`.
We need to make sure the additional scopes get called afterwards.
    @tvdeyen
    tvdeyen committed Jul 7, 2021
    Configuration menu
    Copy the full SHA
    02d7e1d View commit details
    Browse the repository at this point in the history

  2. Do not leak all elements for guest user in API 

    CanCanCan does not respect any scope set before `accessible_by`.

We need to make sure the additional scopes get called afterwards.
    @tvdeyen
    tvdeyen committed Jul 7, 2021
    Configuration menu
    Copy the full SHA
    c814a15 View commit details
    Browse the repository at this point in the history

  3. Only eager load if no page_id is passed 

    Somehow with the recent fix for cancancan accessible_by the eager loading
of elements contents and essences broke
with "cannot eager load polymorphic association essence".

Since we soft-deprecated essences anyway and this API is mostly used by the
page select in the link overlay we can live with the downside
    @tvdeyen
    tvdeyen committed Jul 7, 2021
    Configuration menu
    Copy the full SHA
    eb4f36b View commit details
    Browse the repository at this point in the history

  4. Make the link overlay spec work again 

    It was not working since we change some UI and was self-pending since.

Fixed the underlying issues and make it more robust by using capybaras wait
feature.
    @tvdeyen
    tvdeyen committed Jul 7, 2021
    Configuration menu
    Copy the full SHA
    f8db000 View commit details
    Browse the repository at this point in the history