Skip to content

AO3-5550 Don't expose restricted work titles to guests on related works pages #5782

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
slavalamp wants to merge 2 commits into from
Closed

AO3-5550 Don't expose restricted work titles to guests on related works pages #5782

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
93121a8
AO3-5550 don't expose restricted work titles to guests
slavalamp May 4, 2026
89e961d
AO3-5550 fix work info displaying wrong
slavalamp May 4, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
40 changes: 40 additions & 0 deletions app/helpers/related_works_helper.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,40 @@
module RelatedWorksHelper
def related_work_title(related_work)
work_link = link_to related_work.title, polymorphic_url(related_work)

if related_work.respond_to?(:unrevealed?) && related_work.unrevealed?
t("related_works.index.unrevealed_work")
elsif related_work.restricted? && !logged_in?
t("related_works.index.restricted_work")
else
work_link
end
end

def related_work_title_with_byline(related_work)
work_link = link_to related_work.title, polymorphic_url(related_work)
creator_link = byline(related_work)

if related_work.respond_to?(:unrevealed?) && related_work.unrevealed?
t("related_works.index.unrevealed_work")
elsif related_work.restricted? && !logged_in?
t("related_works.index.restricted_work_by_html", creator_link: creator_link)
else
t("related_works.index.revealed_work_by_html",
work_link: work_link,
creator_link: creator_link)
end
end

def related_work_relation(related_work, relation)
work_link = link_to related_work.title, polymorphic_url(related_work)

if related_work.respond_to?(:unrevealed?) && related_work.unrevealed?
t(".#{relation}.unrevealed")
elsif related_work.restricted? && !logged_in?
t(".#{relation}.restricted")
else
t(".#{relation}.revealed_html", work_link: work_link)
end
end
end
37 changes: 16 additions & 21 deletions app/views/related_works/index.html.erb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,10 +36,10 @@
<% if related_work.parent && related_work.work %>
<tr>
<% if related_work.work.unrevealed? %>
<td><%= ts("A work in an unrevealed collection") %></td>
<td><%= t(".unrevealed_work") %></td>
<% else %>
<td scope="row"><%= link_to related_work.work.title, related_work.work %> <%= ts("by") %> <%= byline(related_work.work) %></td>
<td><%= link_to related_work.parent.title, related_work.parent %></td>
<td scope="row"><%= related_work_title_with_byline(related_work.work) %></td>
<td><%= related_work_title(related_work.parent) %></td>
<td>
<%= ts("From") %> <%= language_link(related_work.parent) %> <%= ts("to") %> <%= language_link(related_work.work) %>
</td>
Expand Down Expand Up @@ -78,14 +78,8 @@
<% @translations_by_user.each do |related_work| %>
<% if related_work.parent && related_work.work %>
<tr>
<td scope="row">
<% if related_work.parent.is_a?(Work) && related_work.parent.unrevealed? %>
<%= ts("A work in an unrevealed collection") %>
<% else %>
<%= link_to related_work.parent.title, related_work.parent %> <%= ts("by") %> <%= byline(related_work.parent) %>
<% end %>
</td>
<td><%= link_to related_work.work.title, related_work.work %></td>
<td scope="row"><%= related_work_title_with_byline(related_work.parent) %></td>
<td><%= related_work_title(related_work.work) %></td>
<td>
<%= ts("From") %> <%= language_link(related_work.parent) %> <%= ts("to") %> <%= language_link(related_work.work) %>
</td>
Expand All @@ -106,11 +100,14 @@
<% if related_work.parent && related_work.work %>
<dt class="child">
<% if related_work.work.unrevealed? %>
<%= ts("A work in an unrevealed collection") %>
<%= t(".unrevealed_work") %>
<% else %>
<%= link_to related_work.work.title, related_work.work %> <%= ts("by") %> <%= byline(related_work.work) %>
<%= related_work_title_with_byline(related_work.work) %>
</dt>
<dd class="parent"><%= ts("was inspired by ") %><%= link_to related_work.parent.title, related_work.parent %>
<%# i18n-tasks-use t("related_works.index.inspired_by.restricted") %>
<%# i18n-tasks-use t("related_works.index.inspired_by.revealed_html") %>
<%# i18n-tasks-use t("related_works.index.inspired_by.unrevealed") %>
<dd class="parent"><%= related_work_relation(related_work.parent, "inspired_by") %>
<% if current_user == @user %>
<span class="submit actions">
<% if related_work.reciprocal? %>
Expand All @@ -134,15 +131,13 @@
<% unless related_work.translation? %>
<% if related_work.parent && related_work.work %>
<dt class="parent">
<% if related_work.parent.is_a?(Work) && related_work.parent.unrevealed? %>
<%= ts("A work in an unrevealed collection") %>
<% else %>
<%= link_to related_work.parent.title, related_work.parent %> <%= ts("by") %> <%= byline(related_work.parent) %>
<% end %>
<%= related_work_title_with_byline(related_work.parent) %>
</dt>
<dd class="child">
<%= ts("inspired") %>
<%= link_to related_work.work.title, related_work.work %>
<%# i18n-tasks-use t("related_works.index.inspired.restricted") %>
<%# i18n-tasks-use t("related_works.index.inspired.revealed_html") %>
<%# i18n-tasks-use t("related_works.index.inspired.unrevealed") %>
<%= related_work_relation(related_work.work, "inspired") %>
<% if current_user == @user %>
<span class="actions"><%= button_to ts("Remove"), related_work_path(related_work), data: { confirm: ts("Are you sure?") }, method: :delete %></span>
<% end %>
Expand Down
12 changes: 12 additions & 0 deletions config/locales/views/en.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2798,7 +2798,19 @@ en:
page_heading: Marked for Later
related_works:
index:
inspired:
restricted: inspired [Restricted Work] (Log in to access.)
revealed_html: inspired %{work_link}
unrevealed: inspired a work in an unrevealed collection
inspired_by:
restricted: was inspired by [Restricted Work] (Log in to access.)
revealed_html: was inspired by %{work_link}
unrevealed: was inspired by a work in an unrevealed collection
page_heading: "%{login}'s Related Works"
restricted_work: "[Restricted Work] (Log in to access.)"
restricted_work_by_html: "[Restricted Work] by %{creator_link} (Log in to access.)"
revealed_work_by_html: "%{work_link} by %{creator_link}"
unrevealed_work: A work in an unrevealed collection
series:
series_module:
hidden_by_admin_alt: "(Hidden by Admin)"
Expand Down
30 changes: 29 additions & 1 deletion features/works/work_related.feature
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -330,7 +330,7 @@ Scenario: External work language
# especially during posting / editing / previewing a work
# especially from the related_works page, which works but redirects to a non-existant page right now

Scenario: Restricted works listed as Inspiration show up [Restricted] for guests
Scenario: Restricted works listed as Inspiration show up [Restricted] for guests on work pages
Given I have related works setup
And a related work has been posted and approved
When I am logged in as "remixer"
Expand All @@ -349,6 +349,34 @@ Scenario: Restricted works listed as Inspiration show up [Restricted] for guests
And I view the work "Followup"
Then I should see "Inspired by [Restricted Work] by inspiration"

Scenario: Restricted works show up [Restricted] for guests on Related Works pages
Given I have related works setup
And a related work has been posted and approved
And a translation has been posted and approved
When I am logged in as "inspiration"
And I lock the work "Worldbuilding"
When I am logged in as "remixer"
And I lock the work "Followup"
When I am logged in as "translator"
And I lock the work "Worldbuilding Translated"
When I am logged out
And I go to inspiration's related works page
Then I should see "[Restricted Work] by remixer"
And I should see "[Restricted Work] by translator"
And I should see "[Restricted Work] (Log in to access.)" within "table#translationsofme"
And I should see "was inspired by [Restricted Work]"
And I should not see "Worldbuilding"
And I should not see "Followup"
When I go to remixer's related works page
Then I should see "[Restricted Work] by inspiration"
And I should see "inspired [Restricted Work]"
And I should not see "Worldbuilding"
And I should not see "Followup"
When I go to translator's related works page
Then I should see "[Restricted Work] by inspiration"
And I should see "[Restricted Work] (Log in to access.)" within "table#translationsbyme"
And I should not see "Worldbuilding"

Scenario: Anonymous works listed as inspiration should have links to the authors,
but only for the authors themselves and admins
Given I have related works setup
Expand Down
Loading