Changeset 14116 for branches/11.0/tests/phpunit/testcases/notifications/functions.php

Timestamp:

03/20/2025 08:24:38 PM (11 months ago)

Author:

dcavins

Message:

Restrict bulk notification management to owner (11.0 branch).

When attempting to manage notifications in bulk, ensure that the current user is either a site admin or owns all of the notifications specified.

Many thanks to Brian Mungah for responsibly reporting the problem.

File:

• branches/11.0/tests/phpunit/testcases/notifications/functions.php (modified) (1 diff)

branches/11.0/tests/phpunit/testcases/notifications/functions.php

@@ -501 +501 @@
         $this->assertTrue( 1 === (int) $n_obj->is_new );
     }
+
+    /**
+     * @group bulk_manage_notifications
+     */
+    public function test_bp_notifications_bulk_manage_notifications_user_must_own_items() {
+        $u1 = self::factory()->user->create();
+        $u2 = self::factory()->user->create();
+
+        // Create notifications
+        $n1 = self::factory()->notification->create( array(
+            'component_name'    => 'messages',
+            'component_action'  => 'new_message',
+            'item_id'           => 99,
+            'user_id'           => $u1,
+        ) );
+        $n2 = self::factory()->notification->create( array(
+            'component_name'    => 'messages',
+            'component_action'  => 'new_message',
+            'item_id'           => 100,
+            'user_id'           => $u1,
+        ) );
+        $n3 = self::factory()->notification->create( array(
+            'component_name'    => 'messages',
+            'component_action'  => 'new_message',
+            'item_id'           => 101,
+            'user_id'           => $u2,
+        ) );
+
+        wp_set_current_user( $u2 );
+        // Attempt to mark all as read.
+        bp_notifications_bulk_manage_notifications( 'read', array( $n1, $n2, $n3 ) );
+
+        // Check status of $n2 (which shouldn't be affected).
+        $n_get = BP_Notifications_Notification::get(
+            array(
+                'id'               => $n2,
+                'component_name'   => 'messages',
+                'component_action' => 'new_message',
+                'is_new'           => 'both',
+            )
+        );
+        $n_obj = reset( $n_get );
+        $this->assertTrue( 1 === (int) $n_obj->is_new );
+
+        // Check status of $n3 (which should be affected).
+        $n_get = BP_Notifications_Notification::get(
+            array(
+                'id'               => $n3,
+                'component_name'   => 'messages',
+                'component_action' => 'new_message',
+                'is_new'           => 'both',
+            )
+        );
+        $n_obj = reset( $n_get );
+        $this->assertTrue( 0 === (int) $n_obj->is_new );
+    }
+
 }