Infrastructure/ghost
0
Fork 0
mirror of https://github.com/TryGhost/Ghost.git synced 2025-04-08 02:52:39 -05:00
Code Issues Activity

🐛 invite permissions for Editor (#7724)

Browse source 
closes #7723

- editor role had no permissions assigned for invites
This commit is contained in:
Katharina Irrgang 2016-11-16 14:49:55 +01:00 • committed by Hannah Wolfe
parent c946e3fc9c
commit 3d3101ad0e
2 changed files with 15 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
core/server/data/schema/fixtures/fixtures.json
View file

@ -365,7 +365,8 @@
"user": "all",
"role": "all",
"client": "all",
"subscriber": ["add"]
"subscriber": ["add"],
"invite": "all"
},
"Author": {
"post": ["browse", "read", "add"],

13
core/test/integration/api/api_invites_spec.js
View file

@ -325,6 +325,19 @@ describe('Invites API', function () {
}).catch(checkForErrorType('NoPermissionError', done));
});
it('CANNOT add an Adminstrator', function (done) {
InvitesAPI.add({
invites: [
{
email: 'test@example.com',
role_id: testUtils.roles.ids.admin
}
]
}, context.editor).then(function () {
done(new Error('Editor should not be able to add an owner'));
}).catch(checkForErrorType('NoPermissionError', done));
});
it('CANNOT add an Author', function (done) {
InvitesAPI.add({
invites: [