@@ -27,7 +27,7 @@ public function test_add_comment()
2727 'local_id ' => 1 ,
2828 'entity_id ' => $ page ->id ,
2929 'entity_type ' => Page::newModelInstance ()->getMorphClass (),
30- 'text ' => $ comment -> text ,
30+ 'text ' => null ,
3131 'parent_id ' => 2 ,
3232 ]);
3333
@@ -43,17 +43,17 @@ public function test_comment_edit()
4343 $ this ->postJson ("/comment/ $ page ->id " , $ comment ->getAttributes ());
4444
4545 $ comment = $ page ->comments ()->first ();
46- $ newText = 'updated text content ' ;
46+ $ newHtml = '<p> updated text content</p> ' ;
4747 $ resp = $ this ->putJson ("/comment/ $ comment ->id " , [
48- 'text ' => $ newText ,
48+ 'html ' => $ newHtml ,
4949 ]);
5050
5151 $ resp ->assertStatus (200 );
52- $ resp ->assertSee ($ newText );
53- $ resp ->assertDontSee ($ comment ->text );
52+ $ resp ->assertSee ($ newHtml , false );
53+ $ resp ->assertDontSee ($ comment ->html , false );
5454
5555 $ this ->assertDatabaseHas ('comments ' , [
56- 'text ' => $ newText ,
56+ 'html ' => $ newHtml ,
5757 'entity_id ' => $ page ->id ,
5858 ]);
5959
@@ -80,62 +80,46 @@ public function test_comment_delete()
8080 $ this ->assertActivityExists (ActivityType::COMMENT_DELETE );
8181 }
8282
83- public function test_comments_converts_markdown_input_to_html ()
84- {
85- $ page = $ this ->entities ->page ();
86- $ this ->asAdmin ()->postJson ("/comment/ $ page ->id " , [
87- 'text ' => '# My Title ' ,
88- ]);
89-
90- $ this ->assertDatabaseHas ('comments ' , [
91- 'entity_id ' => $ page ->id ,
92- 'entity_type ' => $ page ->getMorphClass (),
93- 'text ' => '# My Title ' ,
94- 'html ' => "<h1>My Title</h1> \n" ,
95- ]);
96-
97- $ pageView = $ this ->get ($ page ->getUrl ());
98- $ pageView ->assertSee ('<h1>My Title</h1> ' , false );
99- }
100-
101- public function test_html_cannot_be_injected_via_comment_content ()
83+ public function test_scripts_cannot_be_injected_via_comment_html ()
10284 {
10385 $ this ->asAdmin ();
10486 $ page = $ this ->entities ->page ();
10587
106- $ script = '<script>const a = "script";</script>\n\n# sometextinthecomment ' ;
88+ $ script = '<script>const a = "script";</script><p onclick="1">My lovely comment</p> ' ;
10789 $ this ->postJson ("/comment/ $ page ->id " , [
108- 'text ' => $ script ,
90+ 'html ' => $ script ,
10991 ]);
11092
11193 $ pageView = $ this ->get ($ page ->getUrl ());
11294 $ pageView ->assertDontSee ($ script , false );
113- $ pageView ->assertSee ('sometextinthecomment ' );
95+ $ pageView ->assertSee ('<p>My lovely comment</p> ' , false );
11496
11597 $ comment = $ page ->comments ()->first ();
11698 $ this ->putJson ("/comment/ $ comment ->id " , [
117- 'text ' => $ script . 'updated ' ,
99+ 'html ' => $ script . '<p> updated</p> ' ,
118100 ]);
119101
120102 $ pageView = $ this ->get ($ page ->getUrl ());
121103 $ pageView ->assertDontSee ($ script , false );
122- $ pageView ->assertSee ('sometextinthecommentupdated ' );
104+ $ pageView ->assertSee ('<p>My lovely comment</p><p>updated</p> ' );
123105 }
124106
125107 public function test_reply_comments_are_nested ()
126108 {
127109 $ this ->asAdmin ();
128110 $ page = $ this ->entities ->page ();
129111
130- $ this ->postJson ("/comment/ $ page ->id " , ['text ' => 'My new comment ' ]);
131- $ this ->postJson ("/comment/ $ page ->id " , ['text ' => 'My new comment ' ]);
112+ $ this ->postJson ("/comment/ $ page ->id " , ['html ' => '<p> My new comment</p> ' ]);
113+ $ this ->postJson ("/comment/ $ page ->id " , ['html ' => '<p> My new comment</p> ' ]);
132114
133115 $ respHtml = $ this ->withHtml ($ this ->get ($ page ->getUrl ()));
134116 $ respHtml ->assertElementCount ('.comment-branch ' , 3 );
135117 $ respHtml ->assertElementNotExists ('.comment-branch .comment-branch ' );
136118
137119 $ comment = $ page ->comments ()->first ();
138- $ resp = $ this ->postJson ("/comment/ $ page ->id " , ['text ' => 'My nested comment ' , 'parent_id ' => $ comment ->local_id ]);
120+ $ resp = $ this ->postJson ("/comment/ $ page ->id " , [
121+ 'html ' => '<p>My nested comment</p> ' , 'parent_id ' => $ comment ->local_id
122+ ]);
139123 $ resp ->assertStatus (200 );
140124
141125 $ respHtml = $ this ->withHtml ($ this ->get ($ page ->getUrl ()));
@@ -147,7 +131,7 @@ public function test_comments_are_visible_in_the_page_editor()
147131 {
148132 $ page = $ this ->entities ->page ();
149133
150- $ this ->asAdmin ()->postJson ("/comment/ $ page ->id " , ['text ' => 'My great comment to see in the editor ' ]);
134+ $ this ->asAdmin ()->postJson ("/comment/ $ page ->id " , ['html ' => '<p> My great comment to see in the editor</p> ' ]);
151135
152136 $ respHtml = $ this ->withHtml ($ this ->get ($ page ->getUrl ('/edit ' )));
153137 $ respHtml ->assertElementContains ('.comment-box .content ' , 'My great comment to see in the editor ' );
@@ -164,4 +148,34 @@ public function test_comment_creator_name_truncated()
164148 $ pageResp = $ this ->asAdmin ()->get ($ page ->getUrl ());
165149 $ pageResp ->assertSee ('Wolfeschlegels… ' );
166150 }
151+
152+ public function test_comment_editor_js_loaded_with_create_or_edit_permissions ()
153+ {
154+ $ editor = $ this ->users ->editor ();
155+ $ page = $ this ->entities ->page ();
156+
157+ $ resp = $ this ->actingAs ($ editor )->get ($ page ->getUrl ());
158+ $ resp ->assertSee ('tinymce.min.js? ' , false );
159+ $ resp ->assertSee ('window.editor_translations ' , false );
160+ $ resp ->assertSee ('component="entity-selector" ' , false );
161+
162+ $ this ->permissions ->removeUserRolePermissions ($ editor , ['comment-create-all ' ]);
163+ $ this ->permissions ->grantUserRolePermissions ($ editor , ['comment-update-own ' ]);
164+
165+ $ resp = $ this ->actingAs ($ editor )->get ($ page ->getUrl ());
166+ $ resp ->assertDontSee ('tinymce.min.js? ' , false );
167+ $ resp ->assertDontSee ('window.editor_translations ' , false );
168+ $ resp ->assertDontSee ('component="entity-selector" ' , false );
169+
170+ Comment::factory ()->create ([
171+ 'created_by ' => $ editor ->id ,
172+ 'entity_type ' => 'page ' ,
173+ 'entity_id ' => $ page ->id ,
174+ ]);
175+
176+ $ resp = $ this ->actingAs ($ editor )->get ($ page ->getUrl ());
177+ $ resp ->assertSee ('tinymce.min.js? ' , false );
178+ $ resp ->assertSee ('window.editor_translations ' , false );
179+ $ resp ->assertSee ('component="entity-selector" ' , false );
180+ }
167181}
0 commit comments