Skip to content

Add WikiDeletePermissionsTest - #3218

Open
labkey-bpatel wants to merge 3 commits into
developfrom
fb_wiki_subtree_delete_1468
Open

labkey-bpatel wants to merge 3 commits into
developfrom
fb_wiki_subtree_delete_1468

Conversation

@labkey-bpatel

@labkey-bpatel labkey-bpatel commented Sep 29, 2026 •

Copy link
Copy Markdown
Contributor

Rationale

Adds automated coverage for the fix to GH Issue 1468: an Author must not be able to delete wiki pages created by other users by deleting the subtree of a page they own.

Related Pull Requests

Changes

  • New WikiDeletePermissionsTest (Daily, Wiki), using two Authors and an Editor.
  • An Author cannot delete a subtree containing another user's child or grandchild. The subtree option is disabled on the confirmation page, direct POST attempts return 403, and the pages, version history, and attachments are preserved.
  • Permissions are re-checked on submit if another user adds a child after the confirmation page is opened.
  • Valid deletes still work: an Author can delete a subtree they fully own, delete only their page and move the child up, and an Editor can delete a subtree containing other users' pages.
  • The existing root-page permission check remains in place, and page names in the new warning are HTML-encoded.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants