diff --git a/lms/djangoapps/discussion/rest_api/api.py b/lms/djangoapps/discussion/rest_api/api.py index e97c80b5d8..9e56c7a32a 100644 --- a/lms/djangoapps/discussion/rest_api/api.py +++ b/lms/djangoapps/discussion/rest_api/api.py @@ -21,6 +21,8 @@ from rest_framework import status from rest_framework.exceptions import PermissionDenied from rest_framework.response import Response from rest_framework.request import Request + +from lms.djangoapps.discussion.views import is_privileged_user from xmodule.course_module import CourseBlock from xmodule.modulestore.django import modulestore from xmodule.tabs import CourseTabList @@ -1174,7 +1176,9 @@ def _handle_abuse_flagged_field(form_value, user, cc_content): else: comment_flagged.send(sender='flag_abuse_for_comment', user=user, post=cc_content) else: - cc_content.unFlagAbuse(user, cc_content, removeAll=False) + remove_all = bool(user.id != cc_content["user_id"] and is_privileged_user(course_key, + User.objects.get(id=user.id))) + cc_content.unFlagAbuse(user, cc_content, remove_all) def _handle_voted_field(form_value, cc_content, api_content, request, context): diff --git a/lms/djangoapps/discussion/rest_api/tests/test_api.py b/lms/djangoapps/discussion/rest_api/tests/test_api.py index 469ddc0c91..2973e3a207 100644 --- a/lms/djangoapps/discussion/rest_api/tests/test_api.py +++ b/lms/djangoapps/discussion/rest_api/tests/test_api.py @@ -2823,6 +2823,36 @@ class UpdateThreadTest( assert httpretty.last_request().method == 'PUT' assert parsed_body(httpretty.last_request()) == {'user_id': [str(self.user.id)]} + @ddt.data( + (False, True), + (True, False), + ) + @ddt.unpack + def test_thread_un_abuse_flag_for_moderator_role(self, is_author, remove_all): + """ + Test un-abuse flag for moderator role. + + When moderator unflags a reported thread, it should + pass the "all" flag to the api. This will indicate + to the api to clear all abuse_flaggers, and mark the + thread as unreported. + If moderator is author of a thread, we want to restrict + the usage of the remove_all flag, so it cant be used + to remove all abuse_flaggers from a moderator post + by the moderator itself. + """ + _assign_role_to_user(user=self.user, course_id=self.course.id, role=FORUM_ROLE_ADMINISTRATOR) + self.register_get_user_response(self.user) + self.register_thread_flag_response("test_thread") + self.register_thread({"abuse_flaggers": ["11"], "user_id": str(self.user.id) if is_author else "12"}) + data = {"abuse_flagged": False} + update_thread(self.request, "test_thread", data) + assert httpretty.last_request().method == 'PUT' + query_params = {'user_id': [str(self.user.id)]} + if remove_all: + query_params.update({'all': ['True']}) + assert parsed_body(httpretty.last_request()) == query_params + def test_invalid_field(self): self.register_thread() with pytest.raises(ValidationError) as assertion: @@ -3278,6 +3308,36 @@ class UpdateCommentTest( assert httpretty.last_request().method == 'PUT' assert parsed_body(httpretty.last_request()) == {'user_id': [str(self.user.id)]} + @ddt.data( + (False, True), + (True, False), + ) + @ddt.unpack + def test_comment_un_abuse_flag_for_moderator_role(self, is_author, remove_all): + """ + Test un-abuse flag for moderator role. + + When moderator unflags a reported comment, it should + pass the "all" flag to the api. This will indicate + to the api to clear all abuse_flaggers, and mark the + comment as unreported. + If moderator is author of a comment, we want to restrict + the usage of the remove_all flag, so it cant be used + to remove all abuse_flaggers from a moderator post + by the moderator itself. + """ + _assign_role_to_user(user=self.user, course_id=self.course.id, role=FORUM_ROLE_ADMINISTRATOR) + self.register_get_user_response(self.user) + self.register_comment_flag_response("test_comment") + self.register_comment({"abuse_flaggers": ["11"], "user_id": str(self.user.id) if is_author else "12"}) + data = {"abuse_flagged": False} + update_comment(self.request, "test_comment", data) + assert httpretty.last_request().method == 'PUT' + query_params = {'user_id': [str(self.user.id)]} + if remove_all: + query_params.update({'all': ['True']}) + assert parsed_body(httpretty.last_request()) == query_params + @ddt.data( FORUM_ROLE_ADMINISTRATOR, FORUM_ROLE_MODERATOR,