github-mirror/discourse
2
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2025-06-04 23:36:11 +08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

FEATURE: hidden site setting to suppress unsecured categories from admins (#19098)

Browse Source 
The hidden site setting `suppress_secured_categories_from_admin` will
suppress visibility of categories without explicit access from admins
in a few key areas (category drop downs and topic lists)

It is not intended to be a security wall since admins can amend any site
setting. Instead it is feature that allows hiding the categories from the
UI.

Admins will still be able to see topics in categories without explicit
access using direct URLs or flags.

Co-authored-by: Alan Guo Xiang Tan <gxtan1990@gmail.com>
This commit is contained in:
Sam
2022-11-18 14:37:36 +11:00
committed by GitHub
parent a6c787345c
commit 4f63bc8ed2
5 changed files with 65 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
lib/guardian/topic_guardian.rb
View File

@ -262,13 +262,13 @@ module TopicGuardian
end
def filter_allowed_categories(records)
unless is_admin?
records = allowed_category_ids.size == 0 ?
records.where('topics.category_id IS NULL') :
records.where('topics.category_id IS NULL or topics.category_id IN (?)', allowed_category_ids)
records = records.references(:categories)
end
records
return records if is_admin? && !SiteSetting.suppress_secured_categories_from_admin
records = allowed_category_ids.size == 0 ?
records.where('topics.category_id IS NULL') :
records.where('topics.category_id IS NULL or topics.category_id IN (?)', allowed_category_ids)
records.references(:categories)
end
def can_edit_featured_link?(category_id)