mirror of
https://github.com/discourse/discourse.git
synced 2026-08-09 21:45:25 +08:00
28b26ca70a## Summary `Guardian#can_see_profile?` did not account for `hide_user_profiles_from_public`, so anonymous visitors could still read target-scoped activity, topic, badge, and user-action data through routes that relied on that predicate. This change makes `can_see_profile?` enforce the global anonymous-profile setting. Existing profile, card, and summary routes retain their explicit forbidden response, while other callers keep their established not-found behavior. Authenticated behavior is unchanged. ## Source - Patch Triage: https://patch.discourse.org/patch-triage/1584 Co-authored-by: discourse-patch-triage <272280883+discourse-patch-triage[bot]@users.noreply.github.com> |
||
|---|---|---|
| .. | ||
| bookmark_guardian.rb | ||
| category_guardian.rb | ||
| ensure_magic.rb | ||
| flag_guardian.rb | ||
| group_guardian.rb | ||
| invite_guardian.rb | ||
| localization_guardian.rb | ||
| permalink_guardian.rb | ||
| post_guardian.rb | ||
| post_revision_guardian.rb | ||
| sidebar_guardian.rb | ||
| staff_action_log_guardian.rb | ||
| tag_guardian.rb | ||
| topic_guardian.rb | ||
| upload_guardian.rb | ||
| user_guardian.rb | ||
