github-mirror/discourse
2
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2025-05-31 12:17:49 +08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

FIX: access to category chat only when user can create post (#19488)

Browse Source 
Previously, restricted category chat channel was available for all groups - even `readonly`. From now on, only user who belong to group with `create_post` or `full` permissions can access that chat channel.
This commit is contained in:
Krzysztof Kotlarek
2022-12-19 11:35:28 +11:00
committed by GitHub
parent 4adb457ced
commit 09d15d4c7f
21 changed files with 170 additions and 49 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
plugins/chat/app/controllers/chat_controller.rb
View File

@ -32,7 +32,7 @@ class Chat::ChatController < Chat::ChatBaseController
def enable_chat
chat_channel = ChatChannel.with_deleted.find_by(chatable: @chatable)
guardian.ensure_can_see_chat_channel!(chat_channel) if chat_channel
guardian.ensure_can_join_chat_channel!(chat_channel) if chat_channel
if chat_channel && chat_channel.trashed?
chat_channel.recover!
@ -40,7 +40,7 @@ class Chat::ChatController < Chat::ChatBaseController
return render_json_error I18n.t("chat.already_enabled")
else
chat_channel = @chatable.chat_channel
guardian.ensure_can_see_chat_channel!(chat_channel)
guardian.ensure_can_join_chat_channel!(chat_channel)
end
success = chat_channel.save
@ -61,7 +61,7 @@ class Chat::ChatController < Chat::ChatBaseController
def disable_chat
chat_channel = ChatChannel.with_deleted.find_by(chatable: @chatable)
guardian.ensure_can_see_chat_channel!(chat_channel)
guardian.ensure_can_join_chat_channel!(chat_channel)
return render json: success_json if chat_channel.trashed?
chat_channel.trash!(current_user)
@ -346,7 +346,7 @@ class Chat::ChatController < Chat::ChatBaseController
.where(id: params[:user_ids])
users.each do |user|
guardian = Guardian.new(user)
if guardian.can_chat? && guardian.can_see_chat_channel?(@chat_channel)
if guardian.can_chat? && guardian.can_join_chat_channel?(@chat_channel)
data = {
message: "chat.invitation_notification",
chat_channel_id: @chat_channel.id,