mirror of
https://github.com/discourse/discourse.git
synced 2026-08-06 13:08:40 +08:00
08eacfdb87
`ReviewableQueuedPostSerializer` unconditionally included `payload["raw_email"]` for posts that arrived via incoming email. Category moderation group members reaching the review queue could therefore read the full inbound email source without being in `view_raw_email_allowed_groups`. The serializer now redacts `raw_email` from the rendered payload unless the current user is in `view_raw_email_allowed_groups`, mirroring the existing check used by `Guardian#can_view_raw_email`. This commit also: - disables click on envelope when user has no raw email access to prevent a deceptive action - adds a new `guardian.can_view_raw_emails?` to avoid duplication of this specific logic https://github.com/discourse/discourse/security/advisories/GHSA-h2jr-whpx-6w63
44 lines
956 B
Ruby
Vendored
44 lines
956 B
Ruby
Vendored
# frozen_string_literal: true
|
|
|
|
class ReviewableQueuedPostSerializer < ReviewableSerializer
|
|
attributes :reply_to_post_number, :fancy_title, :cooked
|
|
|
|
payload_attributes(
|
|
:raw,
|
|
:title,
|
|
:archetype,
|
|
:category,
|
|
:visible,
|
|
:is_warning,
|
|
:first_post_checks,
|
|
:featured_link,
|
|
:is_poll,
|
|
:typing_duration_msecs,
|
|
:composer_open_duration_msecs,
|
|
:tags,
|
|
:via_email,
|
|
:raw_email,
|
|
)
|
|
|
|
def attributes
|
|
data = super
|
|
data[:payload]&.delete("raw_email") unless scope&.can_view_raw_emails?
|
|
data
|
|
end
|
|
|
|
def fancy_title
|
|
ERB::Util.html_escape(object.payload["title"]) if object.payload&.[]("title")
|
|
end
|
|
|
|
def cooked
|
|
PrettyText.cook(object.payload["raw"]) if object.payload&.[]("raw")
|
|
end
|
|
|
|
def reply_to_post_number
|
|
object.payload["reply_to_post_number"].to_i
|
|
end
|
|
|
|
def include_reply_to_post_number?
|
|
object.payload.present? && object.payload["reply_to_post_number"].present?
|
|
end
|
|
end
|
