0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-14 13:58:53 +08:00
discourse/plugins/discourse-policy/config/locales/server.en.yml
Alan Guo Xiang Tan 451ed6aa98 SECURITY: Validate policy permissions on post save
The `create_policy_allowed_groups` setting controls who can create
policies, but it only gates the composer UI and the
`post_process_cooked` event handler. It does not prevent unauthorized
users from injecting `[policy]` markup directly into post raw — for
example, by editing a wiki post.

Add `DiscoursePolicy::PostValidator` as an ActiveRecord validation on
`Post`. When policies are added, removed, or modified, both the post
owner and the acting user must belong to `create_policy_allowed_groups`
or the save is rejected. Policies inside blockquotes are ignored.
2026-03-19 15:21:28 +00:00

37 lines
1.5 KiB
YAML
Vendored

en:
site_settings:
policy_enabled: "Allow policies?"
policy_restrict_to_staff_posts: "Policies may only appear on staff posts"
create_policy_allowed_groups: "Group membership required for adding policies to posts"
policy_easy_revoke: "Show the accept and revoke buttons at the same time"
discourse_policy:
errors:
user_missing: "User does not exist in group"
group_not_found: "Group not found for policy"
no_policy: "No policy exists for post"
staff_only: "Policies may only apply to staff posts"
policy_group_inaccessible: "This policy cannot be accepted at this time. Please contact a site administrator."
no_policy_permission: "You do not have permission to modify policies in this post."
error:
no_permission: "Not authorized"
reports:
unaccepted-policies:
title: Unaccepted policies
labels:
topic_id: Topic ID
user_id: User ID
user_notifications:
policy_email:
from: "%{site_name}"
subject: "A policy needs your review: %{topic_title}"
visit_topic: "Visit Topic"
visit_link_to_respond: "%{visit_topic_link} to respond."
unsubscribe: "Change your %{email_preferences_link}, or %{unsubscribe_link} to unsubscribe."
your_policy_email_settings: "policy emails frequency preference"
unsubscribe:
policy_emails:
select_title: "Set policy alert emails frequency to:"
never: Never
when_away: Only when away
always: Always