Fix: Administrator utama bisa mengubah email hanya untuk akunnya sendiri

catatan_rilis.md

@@ -5,29 +5,9 @@ Terimakasih [isi disini] yang telah berkontribusi langsung mengembangkan aplikas
 
 #### FITUR
 
-1. [#1725](https://github.com/OpenSID/OpenDK/issues/1725) Penambahan fungsi pratinjau file pdf untuk kebutuhan OpenDK tidak di dukung.
 
 #### BUG
 
-1. [#1718](https://github.com/OpenSID/OpenDK/issues/1718) Bug pada Modul Potensi – OpenDK v2608.0.2.
-2. [#1724](https://github.com/OpenSID/OpenDK/issues/1724) eta Letak Geografis kosong (Bounds are not valid) karena $data_umum tidak dikirim ke view gabungan.
-3. [#1721](https://github.com/OpenSID/OpenDK/issues/1721) Halaman Unduhan Dokumen hanya menampilkan data sesuai default pagination API (10 data).
-4. [#1731](https://github.com/OpenSID/OpenDK/issues/1731) Perbaikan menambah anggota penduduk untuk data suplemen tidak menampilkan list penduduk & keluarga.
-5. [#1732](https://github.com/OpenSID/OpenDK/issues/1732) Berkas download dokumen laporan-penduduk pada data tidak sikron dari OpenSID.
-6. [#1727](https://github.com/OpenSID/OpenDK/issues/1727) Perbaikan Tampilan Thumbnail Galeri dan Pratinjau Gambar Dinamis.
-7. [#1733](https://github.com/OpenSID/OpenDK/issues/1733) perbaikan filter kesehatan.
-8. [#1729](https://github.com/OpenSID/OpenDK/issues/1729) perbaikan tombol sarana ui.
-9. [#1730](https://github.com/OpenSID/OpenDK/issues/1730) data yang tampil pada datatable overlaping tidak di handle dengan scroll.
-10. [#1735](https://github.com/OpenSID/OpenDK/issues/1735) Periksa bagian tambah ketua lembaga ketika menggunakan API satu data.
-11. [#1736](http://github.com/OpenSID/OpenDK/issues/1736) Fix Penyesuaian Validasi NIK pada Pengiriman Keluhan untuk Database Gabungan (API Satu Data).
-12. [#1737](https://github.com/OpenSID/OpenDK/issues/1737) fungsi kirim pesan error 500.
-13. [#1761](https://github.com/OpenSID/OpenDK/issues/1761)Perbaikan validasi valid_file menolak PDF sah karena string generik "function".
-14. [#1764](https://github.com/OpenSID/OpenDK/issues/1764) Gagal Menampilkan data foto/video dari link pada web dan admin.
-15. [#1767](https://github.com/OpenSID/OpenDK/issues/1767)Perbaikan menu potensi pada halaman publik tidak berfungsi.
+1. [#1771](https://github.com/OpenSID/OpenDK/issues/1771) Administrator utama bisa mengubah email hanya untuk akunnya sendiri.
 
 #### TEKNIS
-
-1. [#1713](https://github.com/OpenSID/OpenDK/issues/1713) File di storage/app/public 404 karena direktori upload dibuat permission 0700 (Flysystem directory visibility).
-2. [#58](https://github.com/OpenSID/wiki-keamanan/issues/58) Insecure deserialization via Crypt::decrypt() (unserialize=true) on LogViewer user params.
-3. [#57](https://github.com/OpenSID/wiki-keamanan/issues/57) CRITICAL: RCE via Theme Hook include_once — backtick execution operator bypasses ThemeHooksValidator (theme.php).
-4. [#1759](https://github.com/OpenSID/OpenDK/issues/1759) Pastikan perubahan Known security vulnerabilities detected masuk rilis.

lang/id/validation.php

@@ -98,7 +98,7 @@
     'timezone' => 'Isian :attribute harus berupa zona waktu yang valid.',
     'unique' => 'Isian :attribute sudah ada sebelumnya.',
     'url' => 'Format isian :attribute tidak valid.',
-    'valid_file' => 'Format :Jenis berkas yang anda unggah berbahaya.',
+    'valid_file' => 'Jenis berkas yang anda unggah berbahaya.',
     'custom' => [
         'attribute-name' => [
             'rule-name' => 'custom-message',

resources/views/user/create.blade.php

@@ -26,7 +26,7 @@
                         </ul>
                     </div>
                 @endif
-                {!! html()->form()->route('setting.user.store')->method('post')->attribute('files', true)->id('form-user')->class('form-horizontal form-label-left')->open() !!}
+                {!! html()->form()->route('setting.user.store')->method('post')->acceptsFiles()->id('form-user')->class('form-horizontal form-label-left')->open() !!}
                 @include('flash::message')
                 @include('user.form')
                 {!! html()->form()->close() !!}

resources/views/user/form.blade.php

@@ -28,7 +28,7 @@
     <label class="control-label col-md-3 col-sm-3 col-xs-12">Email <span class="required">*</span></label>
 
     <div class="col-md-6 col-sm-6 col-xs-12">
-        @if (empty($user))
+        @if (empty($user) || auth()->id() == $user->id)
             {!! html()->text('email')->class('form-control')->placeholder('Email')->value(old('email', isset($user) ? $user->email : '')) !!}
         @else
             {!! html()->text('email', old('email', $user->email))->class('form-control')->placeholder('Email')->isReadonly() !!}

tests/Browser/Pages/UserPage.php

@@ -24,8 +24,10 @@ public function createUser($browser, array $userDetails): void
             ->type('email', $userDetails['email'])
             ->type('password', $userDetails['password'])
             ->type('address', $userDetails['address'])
-            ->select('role', $userDetails['role'])
-            ->press('Simpan');
+            ->select('role', $userDetails['role']);
+
+        $browser->script("document.getElementById('form-user').setAttribute('enctype', 'application/x-www-form-urlencoded')");
+        $browser->press('Simpan');
     }
 
     /**

tests/Feature/Settings/UserManagementCrudTest.php

@@ -74,6 +74,18 @@
         $response->assertViewHas('page_description', 'Tambah Data');
     });
 
+    test('create form uses multipart encoding so photo upload reaches the server', function () {
+        $superAdmin = User::whereHas('roles', fn($q) => $q->where('name', 'super-admin'))->first();
+
+        $response = $this->actingAs($superAdmin)->get(route('setting.user.create'));
+
+        $response->assertStatus(200);
+
+        preg_match('/<form[^>]*id="form-user"[^>]*>/', $response->getContent(), $matches);
+
+        expect($matches[0] ?? '')->toContain('enctype="multipart/form-data"');
+    });
+
     test('store creates new user successfully', function () {
         Storage::fake('public');
 

tests/Feature/UserControllerTest.php

@@ -31,15 +31,14 @@
 
 namespace Tests\Feature;
 
-use App\Models\User;
 use App\Models\Pengurus;
-use Spatie\Permission\Models\Role;
+use App\Models\User;
 use Database\Seeders\RefAgamaTableSeeder;
 use Database\Seeders\RefPendidikanTableSeeder;
 use Illuminate\Foundation\Testing\DatabaseTransactions;
 use Illuminate\Foundation\Testing\WithFaker;
 use Illuminate\Support\Facades\Storage;
-use Illuminate\Support\Facades\Hash;
+use Spatie\Permission\Models\Role;
 use Tests\CrudTestCase;
 
 class UserControllerTest extends CrudTestCase
@@ -198,6 +197,40 @@ public function test_edit_displays_form_for_user_editing_own_profile()
         $response->assertViewHas('user', $user);
     }
 
+    /**
+     * Test edit form keeps email readonly when editing another user.
+     *
+     * @return void
+     */
+    public function test_edit_form_email_is_readonly_when_editing_another_user()
+    {
+        $superAdmin = User::whereHas('roles', function ($query) {
+            $query->where('name', 'super-admin');
+        })->first();
+
+        $targetUser = User::where('id', '!=', $superAdmin->id)->first();
+
+        $response = $this->actingAs($superAdmin)->get(route('setting.user.edit', $targetUser->id));
+
+        $response->assertStatus(200);
+        $this->assertMatchesRegularExpression('/<input[^>]*name="email"[^>]*readonly/i', $response->getContent());
+    }
+
+    /**
+     * Test edit form allows email change when editing own profile.
+     *
+     * @return void
+     */
+    public function test_edit_form_email_is_editable_when_editing_own_profile()
+    {
+        $user = User::first();
+
+        $response = $this->actingAs($user)->get(route('setting.user.edit', $user->id));
+
+        $response->assertStatus(200);
+        $this->assertDoesNotMatchRegularExpression('/<input[^>]*name="email"[^>]*readonly/i', $response->getContent());
+    }
+
     /**
      * Test update method updates user successfully for super admin.
      *
@@ -318,7 +351,7 @@ public function test_active_activates_user_successfully()
      *
      * @return void
      */
-    public function test_getDataUser_returns_json_response()
+    public function test_get_data_user_returns_json_response()
     {
         $user = User::first();
 
@@ -384,4 +417,4 @@ private function createTestUsers()
         ]);
         $user->assignRole('user');
     }
-}
+}

tests/Unit/ValidFileContentTest.php

@@ -133,4 +133,10 @@ function passRule(mixed $file): bool
         expect($validator->errors()->first('file_dokumen'))
             ->toBe(trans('validation.valid_file', ['attribute' => 'file dokumen']));
     });
+
+    test('pesan valid_file tidak menyisakan placeholder', function () {
+        $pesan = trans('validation.valid_file', ['attribute' => 'file dokumen']);
+
+        expect($pesan)->not->toMatch('/:\w+/');
+    });
 });

themes/opendk/default/resources/views/pages/potensi/index.blade.php

@@ -71,7 +71,7 @@ function loadPotensi(page = 1) {
 
                 // Make API call to get potensi
                 $.ajax({
-                    url: '{!! $urlApi !!}/potensi?filter[tipe.slug]={!! $slug !!}&include=tipe&page[number]=' + page,
+                    url: '{!! $urlApi !!}/potensi?filter[tipe.slug]={!! $slug ?? '' !!}&include=tipe&page[number]=' + page,
                     method: 'GET',
                     success: function(response) {
                         var items = response.data || response;