mirror of
https://github.com/discourse/discourse.git
synced 2026-08-05 19:53:47 +08:00
## Summary Regular users can access metadata (URL, author, timestamp) of links in staff-only whisper posts or deleted posts via the composer messages endpoint because the lookup logic failed to verify post visibility permissions. ## Source - Patch Triage: https://patch.discourse.org/patch-triage/1158 - HackerOne report: https://hackerone.com/reports/3721825 --- 🤖 Auto-generated from the patch diff via Patch Triage. Review carefully before merging. Co-authored-by: discourse-patch-triage <272280883+discourse-patch-triage[bot]@users.noreply.github.com>
38 lines
1 KiB
Ruby
Vendored
38 lines
1 KiB
Ruby
Vendored
# frozen_string_literal: true
|
|
|
|
class ComposerMessagesController < ApplicationController
|
|
requires_login
|
|
|
|
def index
|
|
finder =
|
|
ComposerMessagesFinder.new(current_user, params.slice(:composer_action, :topic_id, :post_id))
|
|
json = { composer_messages: [finder.find].compact }
|
|
|
|
if params[:topic_id].present?
|
|
topic = Topic.where(id: params[:topic_id]).first
|
|
if guardian.can_see?(topic)
|
|
json[:extras] = { duplicate_lookup: TopicLink.duplicate_lookup(topic, guardian) }
|
|
end
|
|
end
|
|
|
|
render_json_dump(json, rest_serializer: true)
|
|
end
|
|
|
|
def user_not_seen_in_a_while
|
|
usernames = params.require(:usernames)
|
|
users = ComposerMessagesFinder.user_not_seen_in_a_while(usernames)
|
|
user_count = users.count
|
|
|
|
json = {
|
|
user_count: user_count,
|
|
usernames: users,
|
|
time_ago:
|
|
AgeWords.time_ago_in_words(
|
|
SiteSetting.pm_warn_user_last_seen_months_ago.month.ago,
|
|
true,
|
|
scope: :"datetime.distance_in_words_verbose",
|
|
),
|
|
}
|
|
render_json_dump(json)
|
|
end
|
|
end
|