Fixes #2776. Overriding permissions to delete metadata when overwriting multiple values.

1 files changed, 74 insertions, 0 deletions

diff --git a/engine/tests/api/metadata.php b/engine/tests/api/metadata.php
index be8ac269c..2461e975e 100644
--- a/engine/tests/api/metadata.php
+++ b/engine/tests/api/metadata.php
@@ -124,6 +124,80 @@ class ElggCoreMetadataAPITest extends ElggCoreUnitTest {
 		$e->delete();
 	}
 
+	// Make sure metadata with multiple values is correctly deleted when re-written
+	// by another user
+	// http://trac.elgg.org/ticket/2776
+	public function test_elgg_metadata_multiple_values() {
+		$u1 = new ElggUser();
+		$u1->username = rand();
+		$u1->save();
+
+		$u2 = new ElggUser();
+		$u2->username = rand();
+		$u2->save();
+
+		$obj = new ElggObject();
+		$obj->owner_guid = $u1->guid;
+		$obj->container_guid = $u1->guid;
+		$obj->access_id = ACCESS_PUBLIC;
+		$obj->save();
+
+		$md_values = array(
+			'one',
+			'two',
+			'three'
+		);
+
+		// need to fake different logins.
+		// good times without mocking.
+		$original_user = elgg_get_logged_in_user_entity();
+		$_SESSION['user'] = $u1;
+		
+		elgg_set_ignore_access(false);
+
+		// add metadata as one user
+		$obj->test = $md_values;
+
+		// check only these md exists
+		$db_prefix = elgg_get_config('dbprefix');
+		$q = "SELECT * FROM {$db_prefix}metadata WHERE entity_guid = $obj->guid";
+		$data = get_data($q);
+
+		$this->assertEqual(count($md_values), count($data));
+		foreach ($data as $md_row) {
+			$md = elgg_get_metadata_from_id($md_row->id);
+			$this->assertTrue(in_array($md->value, $md_values));
+			$this->assertEqual('test', $md->name);
+		}
+
+		// add md w/ same name as a different user
+		$_SESSION['user'] = $u2;
+		$md_values2 = array(
+			'four',
+			'five',
+			'six',
+			'seven'
+		);
+
+		$obj->test = $md_values2;
+
+		$q = "SELECT * FROM {$db_prefix}metadata WHERE entity_guid = $obj->guid";
+		$data = get_data($q);
+
+		$this->assertEqual(count($md_values2), count($data));
+		foreach ($data as $md_row) {
+			$md = elgg_get_metadata_from_id($md_row->id);
+			$this->assertTrue(in_array($md->value, $md_values2));
+			$this->assertEqual('test', $md->name);
+		}
+
+		$_SESSION['user'] = $original_user;
+
+		$obj->delete();
+		$u1->delete();
+		$u2->delete();
+	}
+
 
 	protected function create_metastring($string) {
 		global $CONFIG, $METASTRINGS_CACHE, $METASTRINGS_DEADNAME_CACHE;