mirror of
https://github.com/discourse/discourse.git
synced 2026-08-07 13:19:19 +08:00
cf34ec28e0## Summary Align private-message read receipts with recipient-group visibility settings. `PostReadersController#ensure_can_see_readers!` (`app/controllers/post_readers_controller.rb:42`) now returns reader details only when the requester can view the membership of every recipient group and belongs to a group with read-state publishing enabled. `TopicView#show_read_indicator?` (`lib/topic_view.rb:297`) applies the same visibility rule to the UI. Realtime `:read` events from `TopicTrackingState.trigger_post_read_count_update` (`app/models/topic_tracking_state.rb:600`) continue to publish `readers_count`, but no longer include `reader_id`. Reader identities remain available through the authorized `/post_readers.json` endpoint. Tests cover group private messages with restricted member visibility. ## Source - Patch Triage: https://patch.discourse.org/patch-triage/1151 Co-authored-by: discourse-patch-triage <272280883+discourse-patch-triage[bot]@users.noreply.github.com> |
||
|---|---|---|
| .. | ||
| db | ||
| fabricators | ||
| fixtures | ||
| generator | ||
| helpers | ||
| import_export | ||
| initializers | ||
| integration | ||
| integrity | ||
| jobs | ||
| lib | ||
| mailers | ||
| migrations | ||
| models | ||
| multisite | ||
| queries/reports | ||
| requests | ||
| script | ||
| serializers | ||
| services | ||
| support | ||
| system | ||
| tasks | ||
| views | ||
| rails_helper.rb | ||
| regenerate_swagger_docs | ||
| swagger_helper.rb | ||
