From 7cd9ef2491196d0bc0614977b945103933b3c497 Mon Sep 17 00:00:00 2001
From: Timo Stollenwerk <timo@zmag.de>
Date: Sat, 17 Oct 2009 13:50:55 +0000
Subject: [PATCH] Changing browser:view registrations to browser:page since
 view doesn't actually do anything with the permissions. This fixes the anyone
 can delete comments problem. evilbungle branch merge.

svn path=/plone.app.discussion/trunk/; revision=30665
---
 plone/app/discussion/browser/configure.zcml |  4 +-
 plone/app/discussion/tests/test_workflow.py | 53 ++++++++++++++++-----
 2 files changed, 43 insertions(+), 14 deletions(-)

diff --git a/plone/app/discussion/browser/configure.zcml b/plone/app/discussion/browser/configure.zcml
index 512e6da..f131592 100644
--- a/plone/app/discussion/browser/configure.zcml
+++ b/plone/app/discussion/browser/configure.zcml
@@ -36,7 +36,7 @@
         />
 
     <!-- Delete comment view -->
-    <browser:view
+    <browser:page
         for="plone.app.discussion.interfaces.IComment"
         name="moderate-delete-comment"
         layer="..interfaces.IDiscussionLayer"
@@ -45,7 +45,7 @@
         />
 
     <!-- Publish comment view -->
-    <browser:view
+    <browser:page
         for="plone.app.discussion.interfaces.IComment"
         name="moderate-publish-comment"
         layer="..interfaces.IDiscussionLayer"
diff --git a/plone/app/discussion/tests/test_workflow.py b/plone/app/discussion/tests/test_workflow.py
index deebe90..ec8acb4 100644
--- a/plone/app/discussion/tests/test_workflow.py
+++ b/plone/app/discussion/tests/test_workflow.py
@@ -4,6 +4,8 @@ from zope.component import createObject
 
 from zope.interface import alsoProvides
 
+from AccessControl import Unauthorized
+
 from Products.PloneTestCase.ptc import PloneTestCase
 
 from plone.app.discussion.tests.layer import DiscussionLayer
@@ -67,20 +69,47 @@ class TestCommentOperations(PloneTestCase):
         alsoProvides(self.portal.REQUEST, IDiscussionLayer)
 
     def test_delete(self):
-        pass
-        #self.portal.REQUEST.form['comment_id'] = self.comment_id
-        #view = self.comment.restrictedTraverse('@@moderate-delete-comment')
-        #view()
-        #self.failIf(self.comment_id in self.conversation.objectIds())
+        self.portal.REQUEST.form['comment_id'] = self.comment_id
+        view = self.comment.restrictedTraverse('@@moderate-delete-comment')
+        view()
+        self.failIf(self.comment_id in self.conversation.objectIds())
+
+    def test_delete_as_anonymous(self):
+        # Make sure that anonymous users can not delete comments
+        self.logout()
+        self.portal.REQUEST.form['comment_id'] = self.comment_id
+        self.assertRaises(Unauthorized,
+                          self.comment.restrictedTraverse,
+                          '@@moderate-delete-comment')
+        self.failUnless(self.comment_id in self.conversation.objectIds())
+
+    def test_delete_as_user(self):
+        # Make sure that members can not delete comments
+        self.logout()
+        self.setRoles(('Member',))
+        self.portal.REQUEST.form['comment_id'] = self.comment_id
+        self.assertRaises(Unauthorized,
+                          self.comment.restrictedTraverse,
+                          '@@moderate-delete-comment')
+        self.failUnless(self.comment_id in self.conversation.objectIds())
 
     def test_publish(self):
-        pass
-        #self.portal.REQUEST.form['comment_id'] = self.comment_id
-        #self.portal.REQUEST.form['action'] = 'publish'
-        #self.assertEquals('pending', self.portal.portal_workflow.getInfoFor(self.comment, 'review_state'))
-        #view = self.reply.restrictedTraverse('@@review-publish-comment')
-        #view()
-        #self.assertEquals('published', self.portal.portal_workflow.getInfoFor(self.comment, 'review_state'))
+        self.portal.REQUEST.form['comment_id'] = self.comment_id
+        self.portal.REQUEST.form['action'] = 'publish'
+        self.assertEquals('pending', self.portal.portal_workflow.getInfoFor(self.comment, 'review_state'))
+        view = self.comment.restrictedTraverse('@@moderate-publish-comment')
+        view()
+        self.assertEquals('published', self.portal.portal_workflow.getInfoFor(self.comment, 'review_state'))
+
+    def test_publish_as_anonymous(self):
+        self.logout()
+        self.portal.REQUEST.form['comment_id'] = self.comment_id
+        self.portal.REQUEST.form['action'] = 'publish'
+        self.assertEquals('pending', self.portal.portal_workflow.getInfoFor(self.comment, 'review_state'))
+        self.assertRaises(Unauthorized,
+                          self.comment.restrictedTraverse,
+                          '@@moderate-publish-comment')
+        self.assertEquals('pending', self.portal.portal_workflow.getInfoFor(self.comment, 'review_state'))
 
 def test_suite():
     return unittest.defaultTestLoader.loadTestsFromName(__name__)
\ No newline at end of file