mirror of
https://github.com/discourse/discourse.git
synced 2026-08-06 13:08:40 +08:00
## Summary Prevent unauthorized disclosure of moderator-hidden post revisions by blocking non-staff historical version requests when a hidden revision exists at or before the requested version. The controller now uses a dedicated Guardian predicate to enforce this range-based authorization before reconstructing post content. Staff retain legitimate access through their existing hidden-revision review permission. ## Source - Patch Triage: https://patch.discourse.org/patch-triage/1113 Co-authored-by: discourse-patch-triage <272280883+discourse-patch-triage[bot]@users.noreply.github.com>
32 lines
819 B
Ruby
Vendored
32 lines
819 B
Ruby
Vendored
# frozen_string_literal: true
|
|
|
|
# mixin for all Guardian methods dealing with post_revisions permissions
|
|
module PostRevisionGuardian
|
|
def can_see_post_revision?(post_revision)
|
|
return false unless post_revision
|
|
return false if post_revision.hidden && !can_view_hidden_post_revisions?
|
|
|
|
can_view_edit_history?(post_revision.post)
|
|
end
|
|
|
|
def can_hide_post_revision?(post_revision)
|
|
is_staff?
|
|
end
|
|
|
|
def can_permanently_delete_post_revisions?
|
|
is_staff? && SiteSetting.can_permanently_delete
|
|
end
|
|
|
|
def can_show_post_revision?(post_revision)
|
|
is_staff?
|
|
end
|
|
|
|
def can_view_post_version?(post, version)
|
|
can_view_hidden_post_revisions? ||
|
|
!PostRevision.where(post_id: post.id, hidden: true, number: ..version).exists?
|
|
end
|
|
|
|
def can_view_hidden_post_revisions?
|
|
is_staff?
|
|
end
|
|
end
|