FIX: respect tl3 links no follow setting (#8232)

lib/cooked_post_processor.rb

@@ -28,6 +28,7 @@ class CookedPostProcessor
     @size_cache = {}
 
     @disable_loading_image = !!opts[:disable_loading_image]
+    @omit_nofollow = post.omit_nofollow?
   end
 
   def post_process(bypass_bump: false, new_post: false)
@@ -580,7 +581,7 @@ class CookedPostProcessor
       end
     end
 
-    if @cooking_options[:omit_nofollow] || !SiteSetting.add_rel_nofollow_to_user_content
+    if @omit_nofollow || !SiteSetting.add_rel_nofollow_to_user_content
       @doc.css(".onebox-body a, .onebox a").each { |a| a.remove_attribute("rel") }
     end
   end
@@ -617,7 +618,7 @@ class CookedPostProcessor
   end
 
   def enforce_nofollow
-    if !@cooking_options[:omit_nofollow] && SiteSetting.add_rel_nofollow_to_user_content
+    if !@omit_nofollow && SiteSetting.add_rel_nofollow_to_user_content
       PrettyText.add_rel_nofollow_to_user_content(@doc)
     end
   end

spec/components/cooked_post_processor_spec.rb

@@ -199,6 +199,12 @@ describe CookedPostProcessor do
           RAW
         end
 
+        let(:staff_post) do
+          Fabricate(:post, user: Fabricate(:admin), raw: <<~RAW)
+          This is a #{url_with_path} topic
+          RAW
+        end
+
         before do
           urls.each do |url|
             stub_request(:get, url).to_return(
@@ -247,6 +253,14 @@ describe CookedPostProcessor do
             text: title,
             count: 1
           )
+
+          expect(html).to have_tag("a[rel='nofollow noopener']")
+        end
+
+        it 'removes nofollow if user is staff/tl3' do
+          cpp = CookedPostProcessor.new(staff_post, invalidate_oneboxes: true)
+          cpp.post_process
+          expect(cpp.html).to_not have_tag("a[rel='nofollow noopener']")
         end
       end
     end
@@ -876,6 +890,27 @@ describe CookedPostProcessor do
     end
   end
 
+  context "#post_process_oneboxes removes nofollow if user is tl3" do
+    let(:post) { build(:post_with_youtube, id: 123) }
+    let(:cpp) { CookedPostProcessor.new(post, invalidate_oneboxes: true) }
+
+    before do
+      post.user.trust_level = TrustLevel[3]
+      post.user.save!
+      SiteSetting.add_rel_nofollow_to_user_content = true
+      SiteSetting.tl3_links_no_follow = false
+      Oneboxer.expects(:onebox)
+        .with("http://www.youtube.com/watch?v=9bZkp7q19f0", invalidate_oneboxes: true, user_id: nil, category_id: post.topic.category_id)
+        .returns('<aside class="onebox"><a href="https://www.youtube.com/watch?v=9bZkp7q19f0" rel="nofollow noopener">GANGNAM STYLE</a></aside>')
+      cpp.post_process_oneboxes
+    end
+
+    it "removes nofollow noopener from links" do
+      expect(cpp).to be_dirty
+      expect(cpp.html).to match_html '<aside class="onebox"><a href="https://www.youtube.com/watch?v=9bZkp7q19f0">GANGNAM STYLE</a></aside>'
+    end
+  end
+
   context "#post_process_oneboxes with oneboxed image" do
     let(:post) { build(:post_with_youtube, id: 123) }
     let(:cpp) { CookedPostProcessor.new(post, invalidate_oneboxes: true) }