mirror of
https://github.com/discourse/discourse.git
synced 2026-08-12 04:31:29 +08:00
5e99b52007
Introduces a `Report.hidden?` class method that consolidates all report visibility checks into a single location. This replaces duplicated conditional logic that was scattered across the controller and query classes. The new method handles: - Admin-only reports (e.g., `top_uploads`) that moderators cannot access - Legacy pageview report visibility based on `use_legacy_pageviews` setting Previously, the controller's `#bulk` and `#show` actions each had their own inline checks for hidden reports, and `Reports::ListQuery` duplicated this logic again. Now all three locations delegate to `Report.hidden?`, making the visibility rules easier to maintain and extend. To prevent accidental privilege escalation, the `admin:` keyword argument is required with no default value. A forgotten parameter now raises an `ArgumentError` rather than silently granting admin access. This parameter flows from `current_user.admin?` in both the reports controller and the admin search controller through to the query and model, ensuring consistent access control. Ref - t/171141
29 lines
956 B
Ruby
Vendored
29 lines
956 B
Ruby
Vendored
# frozen_string_literal: true
|
|
|
|
class Admin::SearchController < Admin::AdminController
|
|
RESULT_TYPES = %w[page setting theme component report].freeze
|
|
|
|
def index
|
|
respond_to do |format|
|
|
format.json do
|
|
render_json_dump(
|
|
settings:
|
|
SiteSetting.all_settings(
|
|
filter_names: params[:filter_names],
|
|
filter_area: params[:filter_area],
|
|
filter_plugin: params[:plugin],
|
|
filter_categories: Array.wrap(params[:categories]),
|
|
include_locale_setting:
|
|
params[:filter_area].blank? || params[:filter_area] == "localization",
|
|
basic_attributes: true,
|
|
),
|
|
themes_and_components:
|
|
serialize_data(Theme.include_relations.order(:name), BasicThemeSerializer),
|
|
reports: Reports::ListQuery.call(admin: current_user.admin?),
|
|
)
|
|
end
|
|
|
|
format.html { render body: nil }
|
|
end
|
|
end
|
|
end
|
