mirror of
https://gh.wpcy.net/https://github.com/discourse/discourse.git
synced 2026-05-05 12:46:33 +08:00
e229fa65a5
Admins can view the list of invites created by other users and they can see the delete button for invites in the list, but it currently doesn't actually delete anything due to a bug in the `invites#destroy` controller action where it looks up the invite record by the given id and expects it to be created by the current user, but when an invite is being deleted by an admin, this logic fails because the invite isn't created by the admin. This commit fixes the issue by removing this check for current user and adding a proper guardian check that validates the action is performed by either the user who created the invite or an admin. Internal topic: t/158288.
64 lines
1.6 KiB
Ruby
64 lines
1.6 KiB
Ruby
# frozen_string_literal: true
|
|
|
|
module InviteGuardian
|
|
def can_see_invite_details?(user)
|
|
is_staff? || is_me?(user)
|
|
end
|
|
|
|
def can_see_invite_emails?(user)
|
|
is_staff? || is_me?(user)
|
|
end
|
|
|
|
def can_invite_to_forum?(groups = nil)
|
|
return false if !authenticated?
|
|
return false if !@user.in_any_groups?(SiteSetting.invite_allowed_groups_map)
|
|
return false if !SiteSetting.max_invites_per_day.to_i.positive? && !is_staff?
|
|
|
|
groups.blank? || groups.all? { |g| can_edit_group?(g) }
|
|
end
|
|
|
|
def can_invite_to?(object, groups = nil)
|
|
return false if !authenticated?
|
|
return false if !object.is_a?(Topic) || !can_see?(object)
|
|
return false if groups.present?
|
|
|
|
if object.is_a?(Topic)
|
|
if object.private_message?
|
|
return true if is_admin?
|
|
|
|
return false if !@user.in_any_groups?(SiteSetting.personal_message_enabled_groups_map)
|
|
return false if object.reached_recipients_limit? && !is_staff?
|
|
end
|
|
|
|
if (category = object.category) && category.read_restricted
|
|
return category.groups&.where(automatic: false)&.any? { |g| can_edit_group?(g) }
|
|
end
|
|
end
|
|
|
|
true
|
|
end
|
|
|
|
def can_invite_via_email?(object)
|
|
return false if !can_invite_to_forum?
|
|
return false if !can_invite_to?(object)
|
|
|
|
(SiteSetting.enable_local_logins || SiteSetting.enable_discourse_connect) &&
|
|
(!SiteSetting.must_approve_users? || is_staff?)
|
|
end
|
|
|
|
def can_bulk_invite_to_forum?
|
|
is_admin?
|
|
end
|
|
|
|
def can_resend_all_invites?
|
|
is_staff?
|
|
end
|
|
|
|
def can_destroy_all_invites?
|
|
is_staff?
|
|
end
|
|
|
|
def can_destroy_invite?(invite)
|
|
invite && (is_admin? || is_me?(invite.invited_by))
|
|
end
|
|
end
|
