0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-06 02:01:03 +08:00
discourse/lib/guardian
Régis Hanol eb75fa45f5
FIX: allow category group moderators to view edit history (#37876)
## Summary

- When `edit_history_visible_to_public` is disabled, category group
moderators using the review panel get an `invalid_access` error when
viewing edit history for posts in their moderated categories
- Allows category group moderators to view edit history for posts in
categories they moderate
- Updates the `edit_history_visible_to_public` setting description to
reflect this change
- Adds guardian specs plus request specs verifying category group
moderators can only view revisions in their moderated categories, and
that hidden revisions remain staff-only (both on the revisions endpoints
and the `?version=` post endpoint)

Based on #37025 by @small-lovely-cat.

Co-authored-by: small-lovely-cat <77799160+small-lovely-cat@users.noreply.github.com>
2026-07-24 16:29:06 +02:00
..
bookmark_guardian.rb
category_guardian.rb PERF: Speed up category visibility checks (#41977) 2026-07-24 07:53:49 +08:00
ensure_magic.rb
flag_guardian.rb
group_guardian.rb
invite_guardian.rb FEATURE: Allow inviting new users directly as admins (#41748) 2026-07-16 14:59:24 -07:00
localization_guardian.rb FIX: Allow manual Community sidebar links to be localized (#41898) 2026-07-22 15:57:56 +08:00
permalink_guardian.rb SECURITY: prevent permalink redirects from leaking restricted slugs 2026-01-28 17:11:14 +00:00
post_guardian.rb FIX: allow category group moderators to view edit history (#37876) 2026-07-24 16:29:06 +02:00
post_revision_guardian.rb
sidebar_guardian.rb
staff_action_log_guardian.rb SECURITY: Restrict staff action logs visibility for moderators 2026-01-28 17:11:14 +00:00
tag_guardian.rb FIX: Don't auto-remove chat members from logged_in_users group (#40543) 2026-06-03 18:15:32 +02:00
topic_guardian.rb FIX: keep private message conversion limited to staff (#41460) 2026-07-06 14:13:48 +05:30
upload_guardian.rb FIX: Enforce secure-upload ACL in AI bot prompt path (#39903) 2026-05-13 09:55:32 +08:00
user_guardian.rb FIX: Post serialization exposes hidden-profile user status messages (#40885) 2026-06-15 09:25:47 -05:00