mirror of
https://github.com/discourse/discourse.git
synced 2026-08-09 21:45:25 +08:00
d32c1381a5Backport of #42321 to release/2026.6. --- ## Summary Topic bookmark creation, listing, search, and reminder eligibility now require the first post to be visible to the user. The fix adds an inner join on the first post with hidden-post filtering to the list query and delegates creation and visibility checks to `guardian.can_see_post?` on the first post, preventing an authenticated user from bookmarking a topic or searching its metadata after the first post is hidden. ## Source - Patch Triage: https://patch.discourse.org/patch-triage/1530 Co-authored-by: discourse-patch-triage <272280883+discourse-patch-triage[bot]@users.noreply.github.com> --------- Co-authored-by: Chris Alberti <christo@discourse.org>
47 lines
1.4 KiB
Ruby
Vendored
47 lines
1.4 KiB
Ruby
Vendored
# frozen_string_literal: true
|
|
|
|
RSpec.describe UserBookmarkList do
|
|
fab!(:user)
|
|
let(:list) { UserBookmarkList.new(user: user, guardian: Guardian.new(user)) }
|
|
|
|
before do
|
|
register_test_bookmarkable
|
|
|
|
Fabricate(:topic_user, user: user, topic: post_bookmark.bookmarkable.topic)
|
|
Fabricate(:topic_user, user: user, topic: topic_bookmark.bookmarkable)
|
|
user_bookmark
|
|
end
|
|
|
|
after { DiscoursePluginRegistry.reset! }
|
|
|
|
let(:post_bookmark) { Fabricate(:bookmark, user: user, bookmarkable: Fabricate(:post)) }
|
|
let(:topic_bookmark) { Fabricate(:bookmark, user: user, bookmarkable: Fabricate(:topic_with_op)) }
|
|
let(:user_bookmark) { Fabricate(:bookmark, user: user, bookmarkable: Fabricate(:user)) }
|
|
|
|
it "returns all types of bookmarks" do
|
|
list.load
|
|
|
|
expect(list.bookmarks.map(&:id)).to match_array(
|
|
[post_bookmark.id, topic_bookmark.id, user_bookmark.id],
|
|
)
|
|
|
|
expect(list.has_more).to eq(false)
|
|
end
|
|
|
|
it "defaults to 20 per page" do
|
|
expect(list.per_page).to eq(20)
|
|
end
|
|
|
|
context "when the per_page param is too high" do
|
|
it "does not allow more than X bookmarks to be requested per page" do
|
|
22.times do
|
|
bookmark = Fabricate(:bookmark, user: user, bookmarkable: Fabricate(:post))
|
|
Fabricate(:topic_user, topic: bookmark.bookmarkable.topic, user: user)
|
|
end
|
|
|
|
list = UserBookmarkList.new(user: user, guardian: Guardian.new(user), per_page: 1000)
|
|
|
|
expect(list.load.count).to eq(20)
|
|
end
|
|
end
|
|
end
|
