#905 Fix a check on survey editable

src/main/java/org/support/project/knowledge/control/protect/SurveyControl.java

@@ -25,9 +25,11 @@
 import org.support.project.knowledge.entity.TemplateMastersEntity;
 import org.support.project.knowledge.logic.KnowledgeLogic;
 import org.support.project.knowledge.logic.SurveyLogic;
+import org.support.project.knowledge.logic.TargetLogic;
 import org.support.project.knowledge.logic.activity.Activity;
 import org.support.project.knowledge.logic.activity.ActivityLogic;
 import org.support.project.knowledge.vo.SurveyReport;
+import org.support.project.web.bean.LabelValue;
 import org.support.project.web.bean.Msg;
 import org.support.project.web.boundary.Boundary;
 import org.support.project.web.common.HttpStatus;
@@ -73,7 +75,8 @@ public Boundary save() throws InstantiationException, IllegalAccessException, JS
             return sendError(HttpStatus.SC_400_BAD_REQUEST, "BAD_REQUEST");
         }
         KnowledgesEntity knowledge = KnowledgeLogic.get().select(knowledgeId, getLoginedUser());
-        if (knowledge == null || !KnowledgeLogic.get().isEditor(super.getLoginedUser(), knowledge, null)) {
+        List<LabelValue> editors = TargetLogic.get().selectEditorsOnKnowledgeId(knowledgeId);
+        if (knowledge == null || !KnowledgeLogic.get().isEditor(super.getLoginedUser(), knowledge, editors)) {
             return sendError(HttpStatus.SC_403_FORBIDDEN, "FORBIDDEN");
         }
         // テンプレートと同じ構造にしているが、アンケートに変換して保存する

src/test/java/org/support/project/knowledge/integration/IntegrationSurveyTest.java

@@ -11,7 +11,9 @@
 import org.support.project.knowledge.dao.NotifyQueuesDao;
 import org.support.project.knowledge.entity.NotifyQueuesEntity;
 import org.support.project.knowledge.logic.KnowledgeLogic;
+import org.support.project.knowledge.logic.TargetLogic;
 import org.support.project.knowledge.logic.TemplateLogic;
+import org.support.project.web.bean.LoginedUser;
 import org.support.project.web.bean.MessageResult;
 import org.support.project.web.bean.Msg;
 import org.support.project.web.boundary.ForwardBoundary;
@@ -215,4 +217,65 @@ public void testActivityHistory() throws Exception {
         assertPointHistoryCount(ANSWER_USER, 2);
     }
 
+    /**
+     * アンケートの編集権限の確認
+     * @throws Exception
+     */
+    @Test
+    @Order(order = 700)
+    public void testEditAble() throws Exception {
+        // 登録
+        StubHttpServletRequest request = new StubHttpServletRequest();
+        StubHttpServletResponse response = new StubHttpServletResponse(request);
+        request.setServletPath("protect.knowledge/view_add");
+        request.setMethod("get");
+        DefaultAuthenticationLogicImpl auth = org.support.project.di.Container.getComp(DefaultAuthenticationLogicImpl.class);
+        auth.setSession(POST_USER, request, response);
+        ForwardBoundary boundary = invoke(request, response, ForwardBoundary.class);
+        Assert.assertEquals("/WEB-INF/views/protect/knowledge/edit.jsp", PropertyUtil.getPrivateFeildOnReflection(String.class, boundary, "path"));
+        String csrfToken = (String) request.getAttribute(HttpRequestCheckLogic.REQ_ID_KEY);
+        Assert.assertNotNull(csrfToken);
+        request.setServletPath("protect.knowledge/save");
+        request.setMethod("post");
+        request.addParameter(HttpRequestCheckLogic.REQ_ID_KEY, csrfToken);
+        request.addParameter("title", "タイトル");
+        request.addParameter("content", "内容");
+        request.addParameter("publicFlag", String.valueOf(KnowledgeLogic.PUBLIC_FLAG_PROTECT));
+        request.addParameter("typeId", String.valueOf(TemplateLogic.TYPE_ID_KNOWLEDGE));
+        LoginedUser answerUser = super.getLoginUser(ANSWER_USER);
+        request.addParameter("groups", TargetLogic.ID_PREFIX_USER + answerUser.getUserId());
+        request.addParameter("editors", TargetLogic.ID_PREFIX_USER + answerUser.getUserId());
+        JsonBoundary jsonBoundary = invoke(request, response, JsonBoundary.class);
+        MessageResult sendObject = (MessageResult) jsonBoundary.getObj();
+        LOG.info(sendObject);
+        Assert.assertEquals(200, sendObject.getCode().intValue());
+
+        Long knowledgeId = new Long(sendObject.getResult());
+
+        // アンケート登録
+        request = new StubHttpServletRequest();
+        response = new StubHttpServletResponse(request);
+        request.setServletPath("protect.survey/load/" + knowledgeId);
+        request.setMethod("get");
+        JsonBoundary msg = invoke(request, response, JsonBoundary.class);
+        Msg result = (Msg) msg.getObj();
+        Assert.assertEquals("survey data is not exists.", result.getMsg());
+        request.setServletPath("protect.survey/save");
+        request.setMethod("post");
+        auth = org.support.project.di.Container.getComp(DefaultAuthenticationLogicImpl.class);
+        auth.setSession(ANSWER_USER, request, response);
+        csrfToken = (String) request.getAttribute(HttpRequestCheckLogic.REQ_ID_KEY);
+        request.addParameter(HttpRequestCheckLogic.REQ_ID_KEY, csrfToken);
+        request.addParameter("knowledgeId", String.valueOf(knowledgeId));
+        request.addParameter("typeName", "アンケート");
+        request.addParameter("itemType", "text_item0");
+        request.addParameter("title_item0", "入力項目1");
+        jsonBoundary = invoke(request, response, JsonBoundary.class);
+        MessageResult messageResult = (MessageResult) jsonBoundary.getObj();
+        LOG.info(messageResult);
+        Assert.assertEquals(HttpStatus.SC_200_OK, messageResult.getCode().intValue());
+    }
+
+
+
 }