0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-06 13:08:40 +08:00
discourse/lib/guardian/post_revision_guardian.rb
Mark VanLandingham e905a7cd12
SECURITY: Block requests for hidden post revisions through historical version reconstruction (#42269)
## Summary

Prevent unauthorized disclosure of moderator-hidden post revisions by
blocking non-staff historical version requests when a hidden revision
exists at or before the requested version. The controller now uses a
dedicated Guardian predicate to enforce this range-based authorization
before reconstructing post content. Staff retain legitimate access
through their existing hidden-revision review permission.

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/1113

Co-authored-by: discourse-patch-triage
<272280883+discourse-patch-triage[bot]@users.noreply.github.com>
2026-08-03 12:27:53 -05:00

32 lines
819 B
Ruby
Vendored

# frozen_string_literal: true
# mixin for all Guardian methods dealing with post_revisions permissions
module PostRevisionGuardian
def can_see_post_revision?(post_revision)
return false unless post_revision
return false if post_revision.hidden && !can_view_hidden_post_revisions?
can_view_edit_history?(post_revision.post)
end
def can_hide_post_revision?(post_revision)
is_staff?
end
def can_permanently_delete_post_revisions?
is_staff? && SiteSetting.can_permanently_delete
end
def can_show_post_revision?(post_revision)
is_staff?
end
def can_view_post_version?(post, version)
can_view_hidden_post_revisions? ||
!PostRevision.where(post_id: post.id, hidden: true, number: ..version).exists?
end
def can_view_hidden_post_revisions?
is_staff?
end
end