FIX: allowed_theme_ids should not be persisted in GlobalSettings (#14756)

* FIX: allowed_theme_ids should not be persisted in GlobalSettings

It was observed that the memoized value of `GlobalSetting.allowed_theme_ids` would be persisted across requests, which could lead to unpredictable/undesired behaviours in a multisite environment.

This change moves that logic out of GlobalSettings so that the returned theme IDs are correct for the current site.

Uses get_set_cache, which ultimately uses DistributedCache, which will take care of multisite issues for us.
This commit is contained in:
jbrw
2021-10-29 11:46:52 -04:00
committed by GitHub
parent 724f1ee9d1
commit cfc62dbace
6 changed files with 21 additions and 39 deletions

View File

@ -282,7 +282,7 @@ class Admin::ThemesController < Admin::AdminController
private
def ban_in_allowlist_mode!
raise Discourse::InvalidAccess if !GlobalSetting.allowed_theme_ids.nil?
raise Discourse::InvalidAccess if !Theme.allowed_remote_theme_ids.nil?
end
def ban_for_remote_theme!