github-mirror/discourse
2
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2025-05-21 18:12:32 +08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

SECURITY: Any group can be invited into a PM.

Browse Source
This commit is contained in:
Guo Xiang Tan
2017-12-14 10:53:21 +08:00
parent 14cfce2827
commit f2565f6c7e
8 changed files with 97 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
app/controllers/topics_controller.rb
View File

@ -467,7 +467,7 @@ class TopicsController < ApplicationController
topic = Topic.find_by(id: params[:topic_id])
if topic.private_message?
guardian.ensure_can_send_private_message!(group)
guardian.ensure_can_invite_group_to_private_message!(group, topic)
topic.invite_group(current_user, group)
render_json_dump BasicGroupSerializer.new(group, scope: guardian, root: 'group')
else