mirror of
https://github.com/discourse/discourse.git
synced 2026-08-06 13:08:40 +08:00
4ce605eb87## Summary Chat message buttons and other interactive actions are write operations, but users with read-only category access could previously trigger them. This change updates `Chat::CreateMessageInteraction` in `plugins/chat/app/services/chat/create_message_interaction.rb:53` to require permission to join the channel rather than permission to preview it. Attempts from read-only users now return a not-found response without creating a `Chat::MessageInteraction`. Request coverage has been added for read-only category channels. ## Source - Patch Triage: https://patch.discourse.org/patch-triage/1324 Co-authored-by: discourse-patch-triage <272280883+discourse-patch-triage[bot]@users.noreply.github.com> |
||
|---|---|---|
| .. | ||
| actions | ||
| chat | ||
| video_conversion | ||
| hashtag_autocomplete_service_spec.rb | ||
