github-mirror/discourse
2
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2025-06-04 10:24:39 +08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

SECURITY: Respect topic permissions when loading draft metadata

Browse Source 
Co-authored-by: Sam Saffron <sam.saffron@gmail.com>
This commit is contained in:
David Taylor
2020-03-23 11:02:24 +00:00
parent 3f9b922d20
commit 5ff505cea6
7 changed files with 188 additions and 83 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
app/models/topic.rb
View File

@ -152,6 +152,20 @@ class Topic < ActiveRecord::Base
# Return private message topics
scope :private_messages, -> { where(archetype: Archetype.private_message) }
PRIVATE_MESSAGES_SQL = <<~SQL
SELECT topic_id
FROM topic_allowed_users
WHERE user_id = :user_id
UNION ALL
SELECT tg.topic_id
FROM topic_allowed_groups tg
JOIN group_users gu ON gu.user_id = :user_id AND gu.group_id = tg.group_id
SQL
scope :private_messages_for_user, ->(user) {
private_messages.where("topics.id IN (#{PRIVATE_MESSAGES_SQL})", user_id: user.id)
}
scope :listable_topics, -> { where('topics.archetype <> ?', Archetype.private_message) }
scope :by_newest, -> { order('topics.created_at desc, topics.id desc') }