Merge lp:~kfogel/launchpad/546943-really-hide-hidden-bug-comments into lp:launchpad

[Karl Fogel]

Make sure that hidden (visible=false) comments cannot be reached via direct link either, except by admin.

[Deryck Hodge (deryck)]

Looks good. Thanks!

review: Approve (code)

=== modified file 'lib/lp/bugs/browser/bugtask.py'
--- lib/lp/bugs/browser/bugtask.py	2010-03-29 13:31:23 +0000
+++ lib/lp/bugs/browser/bugtask.py	2010-04-01 18:39:29 +0000
@@ -485,7 +485,12 @@
         # I have chosed to use this simple solution for now.
         #   -- kiko, 2006-07-11
         try:
-            return comments[index]
+            comment = comments[index]
+            if (comment.visible
+                or check_permission('launchpad.Admin', self.context)):
+                return comment
+            else:
+                return None
         except IndexError:
             return None
 

=== modified file 'lib/lp/bugs/stories/bugs/xx-bug-hidden-comments.txt'
--- lib/lp/bugs/stories/bugs/xx-bug-hidden-comments.txt	2009-08-28 14:31:15 +0000
+++ lib/lp/bugs/stories/bugs/xx-bug-hidden-comments.txt	2010-04-01 18:39:29 +0000
@@ -8,13 +8,13 @@
     ...     'http://bugs.launchpad.dev'
     ...     '/jokosher/+bug/11')
     >>> user_browser.getControl(name='field.comment').value = (
-    ...     'This comment will not visible when the test completes.')
+    ...     'This comment will not be visible when the test completes.')
     >>> user_browser.getControl('Post Comment', index=-1).click()
     >>> main_content = find_main_content(user_browser.contents)
     >>> new_comment = main_content('div', 'boardCommentBody')[-1]
     >>> new_comment_text = extract_text(new_comment.div)
     >>> print new_comment_text
-    This comment will not visible when the test completes.
+    This comment will not be visible when the test completes.
 
 Admin users can set a message's visible attribute to False.
 In this case, the last message in the list, the one just added,
@@ -26,7 +26,7 @@
     >>> bug_11 = getUtility(IBugSet).get(11)
     >>> message = bug_11.messages[-1]
     >>> print message.text_contents
-    This comment will not visible when the test completes.
+    This comment will not be visible when the test completes.
     >>> bug_message = getUtility(IBugMessageSet).getByBugAndMessage(
     ...     bug_11, message)
     >>> bug_message.visible = False
@@ -46,7 +46,21 @@
     This title, however, is the same as the bug title and so it will
     be suppressed in the UI.
 
-For admin users, the message is still visible.
+Ordinary users also cannot reach the message via direct link.
+
+    >>> comments = find_tags_by_class(
+    ...     user_browser.contents, 'boardComment')
+    >>> for comment in comments:
+    ...     number_node = comment.find(None, 'bug-comment-index')
+    ...     latest_index = extract_text(number_node)
+    >>> user_browser.open(
+    ...     'http://bugs.launchpad.dev'
+    ...     '/jokosher/+bug/11/comments/%d' % (int(latest_index[1:]) + 1))
+    Traceback (most recent call last):
+    ...
+    NotFound...
+
+For admin users, the message is still visible in the bug page.
 
     >>> admin_browser.open(
     ...     'http://bugs.launchpad.dev'
@@ -55,10 +69,27 @@
     >>> last_comment = main_content('div', 'boardCommentBody')[-1]
     >>> last_comment_text = extract_text(last_comment.div)
     >>> print last_comment_text
-    This comment will not visible when the test completes.
+    This comment will not be visible when the test completes.
 
-Also, admin users will see the hidden message grayed out via an
+Admin users will see the hidden message highlighted with an
 'adminHiddenComment' style.
 
     >>> print last_comment.parent['class']
     boardComment adminHiddenComment
+
+Admin users can also reach the message via direct link, and it is
+highlighted with the 'adminHiddenComment style there too.
+
+    >>> admin_browser.open(
+    ...     'http://bugs.launchpad.dev'
+    ...     '/jokosher/+bug/11/comments/%d' % (int(latest_index[1:]) + 1))
+    >>> contents = extract_text(admin_browser.contents)
+    >>> print contents
+    Comment #7 : Bug #11 ...
+    This comment will not be visible when the test completes.
+    ...
+    >>> main_content = find_main_content(admin_browser.contents)
+    >>> last_comment = main_content('div', 'boardCommentBody')[-1]
+    >>> last_comment_text = extract_text(last_comment.div)
+    >>> print last_comment.parent['class']
+    boardComment adminHiddenComment