0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-04 10:39:43 +08:00
discourse/app/serializers/draft_serializer.rb
Isaac Janzen 76ec74ee26
FIX: DraftSerializer leaks real names of topic and post authors (#42197)
## Summary

Prevent the disclosure of topic and post authors' real names in the
drafts list by gating the name attribute behind the site-wide display
names setting. This ensures that DraftSerializer correctly respects
privacy settings when serializing draft metadata for replied-to content.

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/1322

Co-authored-by: discourse-patch-triage
<272280883+discourse-patch-triage[bot]@users.noreply.github.com>
2026-07-31 09:17:27 -05:00

93 lines
1.5 KiB
Ruby
Vendored

# frozen_string_literal: true
require_relative "post_item_excerpt"
class DraftSerializer < ApplicationSerializer
include PostItemExcerpt
attributes :created_at,
:draft_key,
:sequence,
:draft_username,
:avatar_template,
:data,
:topic_id,
:username,
:username_lower,
:name,
:user_id,
:title,
:slug,
:category_id,
:closed,
:archetype,
:archived
def cooked
object.parsed_data["reply"] || ""
end
def draft_username
object.user.username
end
def avatar_template
object.user.avatar_template
end
def username
object.display_user&.username
end
def username_lower
object.display_user&.username_lower
end
def name
object.display_user&.name
end
def include_name?
SiteSetting.enable_names?
end
def title
object.topic&.title
end
def slug
object.topic&.slug
end
def category_id
object.topic&.category_id
end
def closed
object.topic&.closed
end
def archived
object.topic&.archived
end
def archetype
object&.topic&.archetype
end
def include_slug?
object.topic&.title&.present?
end
def include_closed?
object.topic&.closed&.present?
end
def include_archived?
object.topic&.archived&.present?
end
def include_category_id?
object.topic&.category_id&.present?
end
end