mirror of
https://github.com/discourse/discourse.git
synced 2026-08-09 21:45:25 +08:00
e905a7cd12## Summary Prevent unauthorized disclosure of moderator-hidden post revisions by blocking non-staff historical version requests when a hidden revision exists at or before the requested version. The controller now uses a dedicated Guardian predicate to enforce this range-based authorization before reconstructing post content. Staff retain legitimate access through their existing hidden-revision review permission. ## Source - Patch Triage: https://patch.discourse.org/patch-triage/1113 Co-authored-by: discourse-patch-triage <272280883+discourse-patch-triage[bot]@users.noreply.github.com>
19 lines
663 B
Ruby
Vendored
19 lines
663 B
Ruby
Vendored
# frozen_string_literal: true
|
|
|
|
RSpec.describe Guardian do
|
|
fab!(:user)
|
|
fab!(:moderator)
|
|
fab!(:post)
|
|
fab!(:hidden_post_revision) { Fabricate(:post_revision, post:, number: 2, hidden: true) }
|
|
|
|
describe "#can_view_post_version?" do
|
|
it "denies non-staff from reconstructing a version through a hidden revision" do
|
|
expect(Guardian.new(user).can_view_post_version?(post, 1)).to eq(true)
|
|
expect(Guardian.new(user).can_view_post_version?(post, 2)).to eq(false)
|
|
end
|
|
|
|
it "allows staff to reconstruct a version through a hidden revision" do
|
|
expect(Guardian.new(moderator).can_view_post_version?(post, 2)).to eq(true)
|
|
end
|
|
end
|
|
end
|
