mirror of
https://github.com/discourse/discourse.git
synced 2026-08-04 10:39:43 +08:00
746000edc8Same-IP user lookups now identify the target by user_id and ip_type rather than accepting a raw IP in params, so the IP is resolved server-side and never round-trips through clients that lack permission to see it. Additionally: - Hide the `suspicious_logins` report (list, bulk, show, CSV export and the security dashboard tile) from non-admin staff lacking `can_see_ip?`. - Hide the IP column and CSV export button on the screened emails page from staff lacking `can_see_ip?`. - Omit `ip_address` from `ScreenedUrlSerializer` for staff lacking `can_see_ip?`. - Require `can_see_ip?` (in addition to `can_see_emails?`) to export the `screened_email` entity. - Record the username (not the IP) in the staff-log context for "delete other accounts with same IP" when the acting user lacks `can_see_ip?`.
17 lines
365 B
Ruby
Vendored
17 lines
365 B
Ruby
Vendored
# frozen_string_literal: true
|
|
|
|
class ScreenedUrlSerializer < ApplicationSerializer
|
|
attributes :url, :domain, :action, :match_count, :last_match_at, :created_at, :ip_address
|
|
|
|
def action
|
|
ScreenedUrl.actions.key(object.action_type).to_s
|
|
end
|
|
|
|
def ip_address
|
|
object.ip_address.try(:to_s)
|
|
end
|
|
|
|
def include_ip_address?
|
|
scope&.can_see_ip?
|
|
end
|
|
end
|
