mirror of
https://github.com/discourse/discourse.git
synced 2026-08-08 15:55:38 +08:00
e8669040d1
The `create_policy_allowed_groups` setting controls who can create policies, but it only gates the composer UI and the `post_process_cooked` event handler. It does not prevent unauthorized users from injecting `[policy]` markup directly into post raw — for example, by editing a wiki post. Add `DiscoursePolicy::PostValidator` as an ActiveRecord validation on `Post`. When policies are added, removed, or modified, both the post owner and the acting user must belong to `create_policy_allowed_groups` or the save is rejected. Policies inside blockquotes are ignored. |
||
|---|---|---|
| .. | ||
| fabricators | ||
| lib | ||
| mailers | ||
| models | ||
| reports | ||
| requests | ||
| serializers | ||
| system | ||
| plugin_spec.rb | ||
