mirror of
https://gh.wpcy.net/https://github.com/discourse/discourse.git
synced 2026-05-08 15:18:58 +08:00
451ed6aa98
The `create_policy_allowed_groups` setting controls who can create policies, but it only gates the composer UI and the `post_process_cooked` event handler. It does not prevent unauthorized users from injecting `[policy]` markup directly into post raw — for example, by editing a wiki post. Add `DiscoursePolicy::PostValidator` as an ActiveRecord validation on `Post`. When policies are added, removed, or modified, both the post owner and the acting user must belong to `create_policy_allowed_groups` or the save is rejected. Policies inside blockquotes are ignored. |
||
|---|---|---|
| .. | ||
| check_policy_spec.rb | ||
| post_validator_spec.rb | ||
| pretty_text_spec.rb | ||
