0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-08 17:53:55 +08:00
discourse/app/serializers/user_post_bookmark_serializer.rb
Chris Alberti 7584509977
SECURITY: Enforce first-post visibility for topic bookmarks [backport 2026.1] (#42356)
Backport of #42321 to release/2026.1.

Manual backport to also include the fix from PR #39873 (commit
05e03eab29) which was never backported to 2026.1

---

## Summary

Topic bookmark creation, listing, search, and reminder eligibility now
require the first post to be visible to the user. The fix adds an inner
join on the first post with hidden-post filtering to the list query and
delegates creation and visibility checks to `guardian.can_see_post?` on
the first post, preventing an authenticated user from bookmarking a
topic or searching its metadata after the first post is hidden.

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/1530

Co-authored-by: discourse-patch-triage
<272280883+discourse-patch-triage[bot]@users.noreply.github.com>

---------

Co-authored-by: Sam <sam.saffron@gmail.com>
Co-authored-by: discourse-patch-triage[bot] <272280883+discourse-patch-triage[bot]@users.noreply.github.com>
Co-authored-by: Gabriel Grubba <70247653+Grubba27@users.noreply.github.com>
2026-08-05 12:53:28 -05:00

51 lines
789 B
Ruby
Vendored

# frozen_string_literal: true
class UserPostBookmarkSerializer < UserPostTopicBookmarkBaseSerializer
def post_id
post.id
end
def linked_post_number
post.post_number
end
def deleted
topic.deleted_at.present? || post.deleted_at.present?
end
def hidden
post.hidden
end
def raw
post.raw
end
def cooked
post.cooked
end
def post_item_excerpt_post
post
end
def bookmarkable_user
@bookmarkable_user ||= post.user
end
# NOTE: In the UI there are special topic-status and topic-link components to
# display the topic URL, this is only used for certain routes like the .ics bookmarks.
def bookmarkable_url
post.full_url
end
private
def topic
post.topic
end
def post
object.bookmarkable
end
end