Wiki page locking

[jywarren]

Overview

For extremely cautious use, for around 10 or so "most visible" pages on the site and/or those related to the staff only (board, for example), we need some locking abilities. Pages like:

• https://publiclab.org/wiki/board (has been hit a lot)
• https://publiclab.org/about
• https://publiclab.org/getting-started

Admins (user.role == "admin") would have ability to lock, and moderators to edit locked pages. We'd show a clear message indicating that it's locked and why, and a way to appeal this, probably by linking to now-draft https://publiclab.org/wiki/moderation. in an alert.

Update: as of #1095, tag creation permissions are done and we now just have to disallow the edit and update actions on https://github.com/publiclab/plots2/blob/master/app/controllers/wiki_controller.rb -- See Tasks, below.

Goal is to keep locking to an absolute minimum -- only for the most trafficked and spam-hit pages. Wiki page edit notifications for anything else. (#396)

---

Tasks

1. Maybe display a lock icon, with Bootstrap tooltip explanation, where Edit button is. (Add "lock" icon and de-linkify Edit tab of "locked" wiki pages #1099)
2. Also, link to a listing of all locked pages, at /tag/locked, from an explanation page at https://publiclab.org/wiki/locked (that'll be done in Add "lock" icon and de-linkify Edit tab of "locked" wiki pages #1099)
3. And an entry in the power tags page to go to /wiki/locked: https://publiclab.org/wiki/power-tags
4. Intercept requests to the edit page. Look to see if the "locked" tag exists, and if it does, redirects back to the wiki page with an error message, by adding just after this line: https://github.com/publiclab/plots2/blob/master/app/controllers/wiki_controller.rb#L74 as follows (complete in Added test to block basic user edits, closes issue #397 #1114):

if @node.has_power_tag('locked') && (current_user.role != "admin" && current_user.role != "moderator")
  flash.now[:warning] = "This page is <a href='/wiki/power-tags#Locking'>locked</a>, and only <a href='/wiki/moderators'>moderators</a> can edit it."
  redirect_to @node.path
end

5. (closed in Added test to block normal user from updating wiki, fixes #397 #1155) We'd want to add the same kind of catch to def update in the same controller (for when you click save on a wiki page), except that we'd want to put all of these lines in an else block, so they don't get run if there's a lock:

https://github.com/publiclab/plots2/blob/master/app/controllers/wiki_controller.rb#L137-L173

• (closed in Added test to block normal user from updating wiki, fixes #397 #1155) Add the tag locked to a page in a test, and make sure a normal user can't edit that page. A test of a wiki page (example: https://github.com/publiclab/plots2/blob/master/test/functional/wiki_controller_test.rb#L124-L133) looks like this:

  test "basic user blocked from updating a locked wiki page" do
    node(:organizers).add_tag('locked', rusers(:admin)) # lock the page with a tag

    # then try updating it
    post :update,
         id:  node(:organizers).id, 
         uid:   rusers(:bob).id, 
         title: ""

    assert_template "wiki/show"
    assert_select ".alert", "expected message"
  end

• follow the steps in the last task to add a test for the "edit" action (in Added test to block basic user edits, closes issue #397 #1114)
• test that admins can indeed access both of the pages above

This issue needs breaking up!

[jywarren]

@ebarry - input on list of pages to lock?

[500swapnil]

Okay so what should I do first?

[jywarren]

Try making a test to ensure a non-admin cannot edit a locked page. Then you should see the PR travis checks fail, and then you can try to implement that feature in the controller action `update` -- make sense?

…

On Fri, Dec 16, 2016 at 12:58 PM, Swapnil Gupta ***@***.***> wrote: Okay so what should I do first? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#397 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AABfJ9b69GH907vDoOJppzTQ1-DOdfexks5rItFGgaJpZM4Hr-y6> .

[500swapnil]

Okay so this test will do I guess
test "basic user blocked from updating a locked wiki page" do
node(:organizers).add_tag('locked', rusers(:admin)) # lock the page with a tag

# then try updating it
post :update,
     id:  node(:organizers).id, 
     uid:   rusers(:bob).id, 
     title: ""

assert_template "wiki/show"
assert_select ".alert", "expected message"

end

[jywarren]

Yes, I believe that's right -- you might also use an `assert_redirected_to` -- and this should correctly test this because the default user in the wiki_controller_test.rb is "bob" -- a regular user.

…

On Fri, Dec 16, 2016 at 1:02 PM, Swapnil Gupta ***@***.***> wrote: Okay so this test will do I guess test "basic user blocked from updating a locked wiki page" do node(:organizers).add_tag('locked', rusers(:admin)) # lock the page with a tag # then try updating it post :update, id: node(:organizers).id, uid: rusers(:bob).id, title: "" assert_template "wiki/show" assert_select ".alert", "expected message" end — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#397 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AABfJ2r157dYyRwED82b7VYNMiMXISbLks5rItIygaJpZM4Hr-y6> .

[500swapnil]

Okay I have opened a PR #1114

[jywarren]

#1114 merged -- now just need the same but for the wiki update action!

[500swapnil]

I have added a PR #1155 for update action. Please have a look!

[jywarren]

I'm going to reopen and suggest one more addition -- a test that admins do not get redirected, but can indeed both edit and update locked wiki pages. @500swapnil - any interest in this last one? It'd just be two tests.

Thanks!!!

[jywarren]

Also, i'd like to request that this line be modified to link to the /wiki/edit/pagetitle rather than the /wiki/locked URL if the current user is an "admin" or "moderator":

https://github.com/publiclab/plots2/blob/master/app/views/wiki/show.html.erb#L45

That way it's easier for admins and mods to actually make edits!

[500swapnil]

@jywarren Yeah I can add. But where should I add the test?

[jywarren]

You could put it alongside the ones that test disallowing normal users' edits. Thanks!

…

On Tue, Jan 3, 2017 at 2:00 PM, Swapnil Gupta ***@***.***> wrote: @jywarren <https://github.com/jywarren> Yeah I can add. But where should I add the test? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#397 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AABfJ6zYiNQ1KLEBRjxxowh7_bV7QXj-ks5rOprZgaJpZM4Hr-y6> .

[500swapnil]

I made a PR #1163. Please have a look.