github-mirror/discourse
2
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2025-05-24 03:36:18 +08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

SECURITY: Hide notifications for inaccessible topics (#19208)

Browse Source 
Filter notifications the user cannot see anymore
via guardian.can_see_topic_ids
This commit is contained in:
Martin Brennan
2022-11-28 10:41:57 +10:00
committed by GitHub
parent 6335b2c7ba
commit c6ee28ec75
2 changed files with 53 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
app/controllers/notifications_controller.rb
View File

@ -40,7 +40,7 @@ class NotificationsController < ApplicationController
end
if notifications.present? && !(params.has_key?(:silent) || @readonly_mode)
if changed = current_user.bump_last_seen_notification!
if current_user.bump_last_seen_notification!
current_user.reload
current_user.publish_notifications_state
end
@ -57,6 +57,8 @@ class NotificationsController < ApplicationController
end
end
notifications = filter_inaccessible_notifications(notifications)
json = {
notifications: serialize_data(notifications, NotificationSerializer),
seen_notification_id: current_user.seen_notification_id
@ -82,6 +84,7 @@ class NotificationsController < ApplicationController
total_rows = notifications.dup.count
notifications = notifications.offset(offset).limit(60)
notifications = filter_inaccessible_notifications(notifications)
render_json_dump(notifications: serialize_data(notifications, NotificationSerializer),
total_rows_notifications: total_rows,
seen_notification_id: user.seen_notification_id,
@ -145,4 +148,9 @@ class NotificationsController < ApplicationController
render_json_dump(NotificationSerializer.new(@notification, scope: guardian, root: false))
end
def filter_inaccessible_notifications(notifications)
topic_ids = notifications.map { |n| n.topic_id }.compact.uniq
accessible_topic_ids = guardian.can_see_topic_ids(topic_ids: topic_ids)
notifications.select { |n| n.topic_id.blank? || accessible_topic_ids.include?(n.topic_id) }
end
end