mirror of
https://github.com/discourse/discourse.git
synced 2026-08-07 13:19:19 +08:00
7e77ce4bd3Currently, theme settings with `type: list` and `list_type: group` require client-side permission checks, but `currentUser.groups` only includes visible groups, not all groups the user belongs to. This makes permission checks unreliable and can leak hidden group membership. To address this, this commit adds an opt-in `resolve_group_membership: true` option that replaces the group ID list with a user_in_SETTING_NAME boolean resolved server-side via `guardian.in_any_groups?`. The original group list is removed from the frontend payload to prevent leaking group IDs. Since theme settings are cached per-theme (not per-user), the resolution happens after the cache lookup during per-request serialization in `ApplicationLayoutPreloader#activated_themes_json`. Example YAML: ```yaml copy_button_allowed_groups: type: list list_type: group resolve_group_membership: true default: "1|3" ``` Frontend usage: ```javascript if (!settings.user_in_copy_button_allowed_groups) return; ```
11 lines
235 B
Ruby
Vendored
11 lines
235 B
Ruby
Vendored
# frozen_string_literal: true
|
|
|
|
class ThemeSettingsManager::List < ThemeSettingsManager
|
|
def list_type
|
|
@opts[:list_type]
|
|
end
|
|
|
|
def resolve_group_membership?
|
|
@opts[:resolve_group_membership] && list_type == "group"
|
|
end
|
|
end
|
