mirror of
https://github.com/discourse/discourse.git
synced 2026-08-06 13:08:40 +08:00
7e77ce4bd3Currently, theme settings with `type: list` and `list_type: group` require client-side permission checks, but `currentUser.groups` only includes visible groups, not all groups the user belongs to. This makes permission checks unreliable and can leak hidden group membership. To address this, this commit adds an opt-in `resolve_group_membership: true` option that replaces the group ID list with a user_in_SETTING_NAME boolean resolved server-side via `guardian.in_any_groups?`. The original group list is removed from the frontend payload to prevent leaking group IDs. Since theme settings are cached per-theme (not per-user), the resolution happens after the cache lookup during per-request serialization in `ApplicationLayoutPreloader#activated_themes_json`. Example YAML: ```yaml copy_button_allowed_groups: type: list list_type: group resolve_group_membership: true default: "1|3" ``` Frontend usage: ```javascript if (!settings.user_in_copy_button_allowed_groups) return; ``` |
||
|---|---|---|
| .. | ||
| bool.rb | ||
| enum.rb | ||
| float.rb | ||
| integer.rb | ||
| list.rb | ||
| objects.rb | ||
| string.rb | ||
| upload.rb | ||
