0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-06 12:09:27 +08:00
discourse/app/serializers/invite_serializer.rb
discoursebot 2ee0e32bc9
SECURITY: Prevent expired invite details from leaking [backport 2026.5] (#41191)
Backport of #41184 to release/2026.5.

---

This PR applies the existing invite-details guard to expired invites,
matching pending invites.

Co-authored-by: Nat <natalie.tay@discourse.org>
2026-06-25 22:01:56 +08:00

96 lines
2 KiB
Ruby
Vendored

# frozen_string_literal: true
class InviteSerializer < ApplicationSerializer
attributes :id,
:invite_key,
:link,
:description,
:email,
:domain,
:emailed,
:can_delete_invite,
:max_redemptions_allowed,
:redemption_count,
:custom_message,
:created_at,
:updated_at,
:expires_at,
:expired
has_many :topics, embed: :object, serializer: BasicTopicSerializer
has_many :groups, embed: :object, serializer: BasicGroupSerializer
def include_invite_key?
can_see_invite_details?
end
def include_link?
can_see_invite_details?
end
def include_description?
can_see_invite_details?
end
def include_email?
options[:show_emails] && !object.redeemed? && can_see_invite_emails?
end
def include_domain?
can_see_invite_details?
end
def include_emailed?
email.present? && can_see_invite_details?
end
def emailed
object.emailed_status != Invite.emailed_status_types[:not_required]
end
def can_delete_invite
scope.can_destroy_invite?(object)
end
def include_custom_message?
email.present? && can_see_invite_details?
end
def include_max_redemptions_allowed?
email.blank? && can_see_invite_details?
end
def include_redemption_count?
email.blank? && can_see_invite_details?
end
def include_topics?
can_see_invite_details?
end
def topics
object.topics.select { |topic| scope.can_see?(topic) }
end
def include_groups?
can_see_invite_details?
end
def expired
object.expired?
end
private
def can_see_invite_details?
return @can_see_invite_details if defined?(@can_see_invite_details)
@can_see_invite_details = scope.can_see_invite_details?(object.invited_by)
end
def can_see_invite_emails?
return @can_see_invite_emails if defined?(@can_see_invite_emails)
@can_see_invite_emails = scope.can_see_invite_emails?(object.invited_by)
end
end