Pages: Prevent update of non-draft pages via draft publish

To prevent the ability to use the draft publish endpoint on non-draft
pages which the user may not have the ability to update by default.

Thanks to SVO for reporting.

app/Entities/Repos/PageRepo.php

@@ -82,6 +82,10 @@ class PageRepo
      */
     public function publishDraft(Page $draft, array $input): Page
     {
+        if (!$draft->draft || $draft->created_by !== user()->id) {
+            throw new PermissionsException('This page is already published or does not belong to you.');
+        }
+
         return (new DatabaseTransaction(function () use ($draft, $input) {
             $draft->draft = false;
             $draft->revision_count = 1;

tests/Entity/PageDraftTest.php

@@ -5,6 +5,7 @@ namespace Tests\Entity;
 use BookStack\Entities\Models\Page;
 use BookStack\Entities\Models\PageRevision;
 use BookStack\Entities\Repos\PageRepo;
+use BookStack\Exceptions\PermissionsException;
 use Tests\TestCase;
 
 class PageDraftTest extends TestCase
@@ -243,4 +244,23 @@ class PageDraftTest extends TestCase
             'slug'  => 'my-page',
         ]);
     }
+
+    public function test_draft_published_can_only_be_used_on_draft_pages()
+    {
+        $page = $this->entities->page();
+        $this->withoutExceptionHandling();
+
+        $exception = null;
+        try {
+            $this->asEditor()->post($page->book->getUrl("/draft/{$page->id}"), ['name' => 'My published drafty']);
+        } catch (\Exception $e) {
+            $exception = $e;
+        }
+
+        $this->assertInstanceOf(PermissionsException::class, $exception);
+        $this->assertStringContainsString('This page is already published or does not belong to you', $exception->getMessage());
+
+        $page->refresh();
+        $this->assertNotEquals('My published drafty', $page->name);
+    }
 }