Merge branch 'master' into release

Author: ssddanbrown

app/Entity.php

@@ -31,11 +31,7 @@ public function matchesOrContains(Entity $entity)
 
         if ($matches) return true;
 
-        if ($entity->isA('chapter') && $this->isA('book')) {
-            return $entity->book_id === $this->id;
-        }
-
-        if ($entity->isA('page') && $this->isA('book')) {
+        if (($entity->isA('chapter') || $entity->isA('page')) && $this->isA('book')) {
             return $entity->book_id === $this->id;
         }
 
@@ -64,15 +60,6 @@ public function views()
         return $this->morphMany('BookStack\View', 'viewable');
     }
 
-    /**
-     * Get just the views for the current user.
-     * @return mixed
-     */
-    public function userViews()
-    {
-        return $this->views()->where('user_id', '=', auth()->user()->id);
-    }
-
     /**
      * Allows checking of the exact class, Used to check entity type.
      * Cleaner method for is_a.

app/Http/Controllers/Controller.php

@@ -42,6 +42,15 @@ public function __construct()
         $this->signedIn = auth()->check();
     }
 
+    /**
+     * Stops the application and shows a permission error if
+     * the application is in demo mode.
+     */
+    protected function preventAccessForDemoUsers()
+    {
+        if (env('APP_ENV', 'production') === 'demo') $this->showPermissionError();
+    }
+
     /**
      * Adds the page title into the view.
      * @param $title
@@ -51,6 +60,18 @@ public function setPageTitle($title)
         view()->share('pageTitle', $title);
     }
 
+    /**
+     * On a permission error redirect to home and display
+     * the error as a notification.
+     */
+    protected function showPermissionError()
+    {
+        Session::flash('error', trans('errors.permission'));
+        throw new HttpResponseException(
+            redirect('/')
+        );
+    }
+
     /**
      * Checks for a permission.
      *
@@ -60,15 +81,18 @@ public function setPageTitle($title)
     protected function checkPermission($permissionName)
     {
         if (!$this->currentUser || !$this->currentUser->can($permissionName)) {
-            Session::flash('error', trans('errors.permission'));
-            throw new HttpResponseException(
-                redirect('/')
-            );
+            $this->showPermissionError();
         }
 
         return true;
     }
 
+    /**
+     * Check if a user has a permission or bypass if the callback is true.
+     * @param $permissionName
+     * @param $callback
+     * @return bool
+     */
     protected function checkPermissionOr($permissionName, $callback)
     {
         $callbackResult = $callback();

app/Http/Controllers/SearchController.php

@@ -62,9 +62,9 @@ public function searchBook(Request $request, $bookId)
             return redirect()->back();
         }
         $searchTerm = $request->get('term');
-        $whereTerm = [['book_id', '=', $bookId]];
-        $pages = $this->pageRepo->getBySearch($searchTerm, $whereTerm);
-        $chapters = $this->chapterRepo->getBySearch($searchTerm, $whereTerm);
+        $searchWhereTerms = [['book_id', '=', $bookId]];
+        $pages = $this->pageRepo->getBySearch($searchTerm, $searchWhereTerms);
+        $chapters = $this->chapterRepo->getBySearch($searchTerm, $searchWhereTerms);
         return view('search/book', ['pages' => $pages, 'chapters' => $chapters, 'searchTerm' => $searchTerm]);
     }
 

app/Http/Controllers/SettingController.php

@@ -31,13 +31,16 @@ public function index()
      */
     public function update(Request $request)
     {
+        $this->preventAccessForDemoUsers();
         $this->checkPermission('settings-update');
+
         // Cycles through posted settings and update them
         foreach($request->all() as $name => $value) {
             if(strpos($name, 'setting-') !== 0) continue;
             $key = str_replace('setting-', '', trim($name));
             Setting::put($key, $value);
         }
+
         session()->flash('success', 'Settings Saved');
         return redirect('/settings');
     }

app/Http/Controllers/UserController.php

@@ -108,15 +108,19 @@ public function edit($id, SocialAuthService $socialAuthService)
      */
     public function update(Request $request, $id)
     {
+        $this->preventAccessForDemoUsers();
         $this->checkPermissionOr('user-update', function () use ($id) {
             return $this->currentUser->id == $id;
         });
+
         $this->validate($request, [
             'name'             => 'required',
             'email'            => 'required|email|unique:users,email,' . $id,
-            'password'         => 'min:5',
-            'password-confirm' => 'same:password',
+            'password'         => 'min:5|required_with:password_confirm',
+            'password-confirm' => 'same:password|required_with:password',
             'role'             => 'exists:roles,id'
+        ], [
+            'password-confirm.required_with' => 'Password confirmation required'
         ]);
 
         $user = $this->user->findOrFail($id);
@@ -130,6 +134,7 @@ public function update(Request $request, $id)
             $password = $request->get('password');
             $user->password = bcrypt($password);
         }
+
         $user->save();
         return redirect('/users');
     }
@@ -144,6 +149,7 @@ public function delete($id)
         $this->checkPermissionOr('user-delete', function () use ($id) {
             return $this->currentUser->id == $id;
         });
+
         $user = $this->user->findOrFail($id);
         $this->setPageTitle('Delete User ' . $user->name);
         return view('users/delete', ['user' => $user]);
@@ -156,6 +162,7 @@ public function delete($id)
      */
     public function destroy($id)
     {
+        $this->preventAccessForDemoUsers();
         $this->checkPermissionOr('user-delete', function () use ($id) {
             return $this->currentUser->id == $id;
         });

app/Role.php

@@ -43,6 +43,16 @@ public function attachPermission(Permission $permission)
      */
     public static function getDefault()
     {
-        return static::where('name', '=', static::$default)->first();
+        return static::getRole(static::$default);
+    }
+
+    /**
+     * Get the role object for the specified role.
+     * @param $roleName
+     * @return mixed
+     */
+    public static function getRole($roleName)
+    {
+        return static::where('name', '=', $roleName)->first();
     }
 }

app/Services/ActivityService.php

@@ -107,7 +107,7 @@ function entityActivity($entity, $count = 20, $page = 0)
     }
 
     /**
-     * Filters out similar acitivity.
+     * Filters out similar activity.
      * @param Activity[] $activity
      * @return array
      */

database/seeds/DummyContentSeeder.php

@@ -12,7 +12,7 @@ class DummyContentSeeder extends Seeder
     public function run()
     {
         $user = factory(BookStack\User::class, 1)->create();
-        $role = \BookStack\Role::where('name', '=', 'admin')->first();
+        $role = \BookStack\Role::getDefault();
         $user->attachRole($role);
 
 

phpunit.xml

@@ -26,6 +26,6 @@
         <env name="QUEUE_DRIVER" value="sync"/>
         <env name="DB_CONNECTION" value="mysql_testing"/>
         <env name="MAIL_PRETEND" value="true"/>
-        <env name="DISABLE_EXTERNAL_SERVICES" value="true"/>
+        <env name="DISABLE_EXTERNAL_SERVICES" value="false"/>
     </php>
 </phpunit>

public/build/.gitignore

@@ -0,0 +1,2 @@
+*
+!.gitignore