mirror of
https://github.com/discourse/discourse.git
synced 2026-03-04 01:15:08 +08:00
e229fa65a5
Admins can view the list of invites created by other users and they can see the delete button for invites in the list, but it currently doesn't actually delete anything due to a bug in the `invites#destroy` controller action where it looks up the invite record by the given id and expects it to be created by the current user, but when an invite is being deleted by an admin, this logic fails because the invite isn't created by the admin. This commit fixes the issue by removing this check for current user and adding a proper guardian check that validates the action is performed by either the user who created the invite or an admin. Internal topic: t/158288.
54 lines
1.1 KiB
Ruby
54 lines
1.1 KiB
Ruby
# frozen_string_literal: true
|
|
|
|
class InviteSerializer < ApplicationSerializer
|
|
attributes :id,
|
|
:invite_key,
|
|
:link,
|
|
:description,
|
|
:email,
|
|
:domain,
|
|
:emailed,
|
|
:can_delete_invite,
|
|
:max_redemptions_allowed,
|
|
:redemption_count,
|
|
:custom_message,
|
|
:created_at,
|
|
:updated_at,
|
|
:expires_at,
|
|
:expired
|
|
|
|
has_many :topics, embed: :object, serializer: BasicTopicSerializer
|
|
has_many :groups, embed: :object, serializer: BasicGroupSerializer
|
|
|
|
def include_email?
|
|
options[:show_emails] && !object.redeemed?
|
|
end
|
|
|
|
def include_emailed?
|
|
email.present?
|
|
end
|
|
|
|
def emailed
|
|
object.emailed_status != Invite.emailed_status_types[:not_required]
|
|
end
|
|
|
|
def can_delete_invite
|
|
scope.can_destroy_invite?(object)
|
|
end
|
|
|
|
def include_custom_message?
|
|
email.present?
|
|
end
|
|
|
|
def include_max_redemptions_allowed?
|
|
email.blank?
|
|
end
|
|
|
|
def include_redemption_count?
|
|
email.blank?
|
|
end
|
|
|
|
def expired
|
|
object.expired?
|
|
end
|
|
end
|
