mirror of
https://github.com/discourse/discourse.git
synced 2026-08-08 17:53:55 +08:00
b55494454dAuthorization for a CSV export was only checked when the export was requested, not when the background job actually ran. This adds a permission check inside `Jobs::ExportCsvFile` so that access always reflects the user's current privileges at the time the data is generated. If the user is not allowed to export the entity, the job stops before any data is produced. The discourse-calendar plugin is updated with a matching `Guardian#can_export_entity?` extension so that legitimate `post_event` exports keep working under the new check. |
||
|---|---|---|
| .. | ||
| discourse_calendar | ||
| discourse_post_event | ||
| tasks | ||
| calendar.rb | ||
| calendar_custom_fields_validator.rb | ||
| calendar_first_day_of_week.rb | ||
| calendar_settings_validator.rb | ||
| calendar_upcoming_events_default_view.rb | ||
| calendar_validator.rb | ||
| event_validator.rb | ||
| group_timezones.rb | ||
| holiday_status.rb | ||
| time_sniffer.rb | ||
| users_on_holiday.rb | ||
