add unit test testUpdateSubmission_answers

Signed-off-by: Timotheus Pokorra <[email protected]>

Author: tpokorra

lib/Controller/ApiController.php

@@ -1216,6 +1216,10 @@ public function updateSubmission(int $formId, int $submissionId, array $answers,
 			throw new OCSBadRequestException('Can only update if AllowEdit is set');
 		}
 
+		if ($submissionId != $submission->getId()) {
+			throw new OCSBadRequestException('Can only update your own submissions');
+		}
+
 		$submission->setTimestamp(time());
 		$this->submissionMapper->update($submission);
 
@@ -1470,7 +1474,7 @@ public function uploadFiles(int $formId, int $questionId, string $shareHash = ''
 	 * @param string[]|array<array{uploadedFileId: string, uploadedFileName: string}> $answerArray
 	 * @param bool $update
 	 */
-	private function storeAnswersForQuestion(Form $form, $submissionId, array $question, array $answerArray, bool $update) {
+	private function storeAnswersForQuestion(Form $form, int $submissionId, array $question, array $answerArray, bool $update) {
 		// get stored answers for this question
 		$storedAnswers = [];
 		if ($update) {

tests/Unit/Controller/ApiControllerTest.php

@@ -680,7 +680,10 @@ public function testUploadFiles() {
 		$this->apiController->uploadFiles(1, 10, '');
 	}
 
-	public function testNewSubmission_answers() {
+	/**
+	 * Values for the mock objects for the following methods: testNewSubmission_answers, testUpdateSubmission_answers.
+	 */
+	public function dataForSubmission_answers() {
 		$form = new Form();
 		$form->setId(1);
 		$form->setHash('hash');
@@ -728,6 +731,16 @@ public function testNewSubmission_answers() {
 			5 => ['ignore unknown question'],
 		];
 
+		return [
+			'test' => [$form, $questions, $answers],
+		];
+	}
+
+	/**
+	 * @dataProvider dataForSubmission_answers()
+	 */
+	public function testNewSubmission_answers($form, $questions, $answers) {
+
 		$this->formMapper->expects($this->once())
 			->method('findById')
 			->with(1)
@@ -882,6 +895,61 @@ public function testNewSubmission_validateSubmission() {
 		$this->apiController->newSubmission(1, [], '');
 	}
 
+	/**
+	 * @dataProvider dataForSubmission_answers()
+	 */
+	public function testUpdateSubmission_answers($form, $questions, $answers) {
+
+		$form->setAllowEdit(true);
+		$submission = new Submission();
+		$submission->setId(12);
+
+		$this->formMapper->expects($this->once())
+			->method('findById')
+			->with(1)
+			->willReturn($form);
+
+		$this->formsService->expects($this->once())
+			->method('getQuestions')
+			->with(1)
+			->willReturn($questions);
+
+		$this->formAccess();
+
+		$this->submissionService
+			->method('validateSubmission')
+			->willReturn(true);
+
+		$this->submissionMapper->expects($this->once())
+			->method('findByFormAndUser')
+			->with(1, 'currentUser')
+			->willReturn($submission);
+
+		$userFolder = $this->createMock(Folder::class);
+		$userFolder->expects($this->once())
+			->method('nodeExists')
+			->willReturn(true);
+
+		$file = $this->createMock(File::class);
+
+		$userFolder->expects($this->once())
+			->method('getById')
+			->willReturn([$file]);
+
+		$folder = $this->createMock(Folder::class);
+
+		$userFolder->expects($this->once())
+			->method('get')
+			->willReturn($folder);
+
+		$this->storage->expects($this->once())
+			->method('getUserFolder')
+			->with('admin')
+			->willReturn($userFolder);
+
+		$this->apiController->updateSubmission(1, 12, $answers, '');
+	}
+
 	public function testDeleteSubmissionNotFound() {
 		$exception = $this->createMock(MapperException::class);