mirror of
https://gh.wpcy.net/https://github.com/discourse/discourse.git
synced 2026-05-27 15:41:10 +08:00
59af844e0e
Group owners can be non-admins and non-moderators. However they still get to see the group history log. Currently, they get to see the email password in plain text. <img width="1111" height="413" alt="Screenshot 2026-04-30 at 6 30 29 PM" src="https://github.com/user-attachments/assets/c40df50c-3ca6-4046-b57c-9960897c115c" /> This fix redacts the values during serialization if the user is not allowed to `admin` the group, which excludes group owners. We'll have a discussion internally if the group history model should even store the email password in plaintext, and consider a migration + redaction when logging. https://github.com/discourse/discourse/security/advisories/GHSA-94c5-j24g-r99f
33 lines
886 B
Ruby
Vendored
33 lines
886 B
Ruby
Vendored
# frozen_string_literal: true
|
|
|
|
class BasicGroupHistorySerializer < ApplicationSerializer
|
|
EMAIL_SETTING_SUBJECTS =
|
|
Set.new(%w[email_password email_username smtp_server smtp_port smtp_ssl_mode])
|
|
|
|
attributes :action, :subject, :prev_value, :new_value, :created_at
|
|
|
|
has_one :acting_user, embed: :objects, serializer: BasicUserSerializer
|
|
has_one :target_user, embed: :objects, serializer: BasicUserSerializer
|
|
|
|
def action
|
|
GroupHistory.actions[object.action]
|
|
end
|
|
|
|
def prev_value
|
|
redact_email_setting_value(object.prev_value)
|
|
end
|
|
|
|
def new_value
|
|
redact_email_setting_value(object.new_value)
|
|
end
|
|
|
|
private
|
|
|
|
def redact_email_setting_value(value)
|
|
return value if value.blank?
|
|
return value if !EMAIL_SETTING_SUBJECTS.include?(object.subject)
|
|
return value if scope&.can_admin_group?(object.group)
|
|
|
|
I18n.t("staff_action_logs.redacted")
|
|
end
|
|
end
|
