github-mirror/discourse
2
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2025-05-22 22:43:33 +08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

SECURITY: Prevent arbitrary topic custom fields from being set

Browse Source 
Why this change?

The `PostsController#create` action allows arbitrary topic custom fields
to be set by any user that can create a topic. Without any restrictions,
this opens us up to potential security issues where plugins may be using
topic custom fields in security sensitive areas.

What does this change do?

1. This change introduces the `register_editable_topic_custom_field` plugin
API which allows plugins to register topic custom fields that are
editable either by staff users only or all users. The registered
editable topic custom fields are stored in `DiscoursePluginRegistry` and
is called by a new method `Topic#editable_custom_fields` which is then
used in the `PostsController#create` controller action. When an unpermitted custom fields is present in the `meta_data` params,
a 400 response code is returned.

2. Removes all reference to `meta_data` on a topic as it is confusing
   since we actually mean topic custom fields instead.
This commit is contained in:
Alan Guo Xiang Tan
2023-10-10 11:23:56 +08:00
committed by Penar Musaraj
parent 0ed20fe1cd
commit 4cb7472376
10 changed files with 162 additions and 90 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
lib/topic_creator.rb
View File

@ -48,7 +48,7 @@ class TopicCreator
setup_tags(topic)
if fields = @opts[:custom_fields]
topic.custom_fields.merge!(fields)
topic.custom_fields = fields
end
DiscourseEvent.trigger(:before_create_topic, topic, self)
@ -122,7 +122,7 @@ class TopicCreator
visible: @opts[:visible],
}
%i[subtype archetype meta_data import_mode advance_draft].each do |key|
%i[subtype archetype import_mode advance_draft].each do |key|
topic_params[key] = @opts[key] if @opts[key].present?
end