Discourse/discourse
Discourse/discourse
2
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2025-09-06 10:50:21 +08:00
Code Packages Activity Actions 9

SECURITY: Any group can be invited into a PM.

Browse source
This commit is contained in:
Guo Xiang Tan 2017-12-14 10:53:21 +08:00
parent 14cfce2827
commit f2565f6c7e
8 changed files with 97 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

7
lib/guardian.rb
View file

@ -285,6 +285,11 @@ class Guardian
is_admin? || (authenticated? && @user.id == user_id)
end
def can_invite_group_to_private_message?(group, topic)
can_see_topic?(topic) &&
can_send_private_message?(group)
end
def can_send_private_message?(target)
is_user = target.is_a?(User)
is_group = target.is_a?(Group)
@ -300,6 +305,8 @@ class Guardian
(is_staff? || SiteSetting.enable_private_messages) &&
# Can't send PMs to suspended users
(is_staff? || is_group || !target.suspended?) &&
# Check group messageable level
(is_staff? || is_user || Group.messageable(@user).where(id: target.id).exists?) &&
# Silenced users can only send PM to staff
(!is_silenced? || target.staff?)
end