Draft lock (DefaultBlogVisibilityUpdater.java): a draft’s view rule is now given to the post’s creator, not to whoever saves. If no creator is set yet, it falls back to the current user. So an admin or other editor saving a draft no longer adds a rule of their own.
Publishing: it now removes every blog-added view rule, whoever it was added for, not only the publisher’s.
Existing posts: a new migration, BlogVisibilityRestrictionMigration.java, removes leftover rules from posts that are already published. BlogUpgradeEventListener runs it when upgrading from a version before 9.15.16, and it is registered in components.txt.
Tests: I updated DefaultBlogVisibilityUpdaterTest and BlogUpgradeEventListenerTest and added BlogVisibilityRestrictionMigrationTest. BlogPostVisibilityIT has a new test that reproduces BLOG-172: an admin edits the draft, the author publishes it, and a guest can then see it.
Please note: a blog-added rule is recognised only by its shape: allow, view only, one user, no groups. A rule an admin sets by hand with exactly that shape on a published post is now removed the next time the post is saved. Before, only the saving user’s own rule was removed on save.
The version 9.15.16 in the upgrade check assumes the fix ships in the next patch release. Change it if the release number is different.
Patrick Koska on 04/Nov/26 12:18
[~acotiuga] I’ve drafted a fix ([https://github.com/xwiki-contrib/application-blog/pull/134]) for this as a first step towards solving BLOG-173 (collaboration on unpublished posts). This fix alone does not yet let non-admin users view a draft of someone else.
*What changed* * *Draft lock* (DefaultBlogVisibilityUpdater.java): a draft’s view rule is now given to the post’s creator, not to whoever saves. If no creator is set yet, it falls back to the current user. So an admin or other editor saving a draft no longer adds a rule of their own. * *Publishing:* it now removes every blog-added view rule, whoever it was added for, not only the publisher’s. * *Existing posts:* a new migration, BlogVisibilityRestrictionMigration.java, removes leftover rules from posts that are already published. BlogUpgradeEventListener runs it when upgrading from a version before 9.15.16, and it is registered in {{{}components.txt{}}}. * *Tests:* I updated {{DefaultBlogVisibilityUpdaterTest}} and {{BlogUpgradeEventListenerTest}} and added {{{}BlogVisibilityRestrictionMigrationTest{}}}. {{BlogPostVisibilityIT}} has a new test that reproduces BLOG-172: an admin edits the draft, the author publishes it, and a guest can then see it.
*Please note:* a blog-added rule is recognised only by its shape: allow, view only, one user, no groups. A rule an admin sets by hand with exactly that shape on a published post is now removed the next time the post is saved. Before, only the saving user’s own rule was removed on save. * The version 9.15.16 in the upgrade check assumes the fix ships in the next patch release. Change it if the release number is different.
Patrick Koska on 04/Nov/26 12:23
[~acotiuga] I’ve drafted a fix ([https://github.com/xwiki-contrib/application-blog/pull/134]) for this as a first step towards solving BLOG-173 (collaboration on unpublished posts). This fix alone does not yet let non-admin users view a draft of someone else.
*What changed* * *Draft lock* (DefaultBlogVisibilityUpdater.java): a draft’s view rule is now given to the post’s creator, not to whoever saves. If no creator is set yet, it falls back to the current user. So an admin or other editor saving a draft no longer adds a rule of their own. * *Publishing:* it now removes every blog-added view rule, whoever it was added for, not only the publisher’s. * *Existing posts:* a new migration, BlogVisibilityRestrictionMigration.java, removes leftover rules from posts that are already published. BlogUpgradeEventListener runs it when upgrading from a version before 9.15.16, and it is registered in {{{}components.txt{}}}. * *Tests:* I updated {{DefaultBlogVisibilityUpdaterTest}} and {{BlogUpgradeEventListenerTest}} and added {{{}BlogVisibilityRestrictionMigrationTest{}}}. {{BlogPostVisibilityIT}} has a new test that reproduces BLOG-172: an admin edits the draft, the author publishes it, and a guest can then see it.
*Please note:* a blog-added rule is recognised only by its shape: allow, view only, one user, no groups. A rule an admin sets by hand with exactly that shape on a published post is now removed the next time the post is saved. Before, only the saving user’s own rule was removed on save. * The version 9.15.16 in the upgrade check assumes the fix ships in the next patch release. Change it if the release number is different.
This message was sent by Atlassian Jira (v9.3.0#930000-sha1:287aeb6)
If image attachments aren't displayed, see this article.
