mirror of
https://github.com/discourse/discourse.git
synced 2026-08-06 13:08:40 +08:00
aec18e9f70Every endpoint that lists tags for browsing hand-rolled its own filter chain, and they had drifted apart. The tags page filtered synonyms out when tags were listed flat but not when they were listed by group, so a synonym of a tag belonging to no tag group was shown next to its target — a duplicate entry whose page only redirects back to the tag it duplicates. Synonyms of grouped tags were hidden by accident rather than by design: creating a synonym copies the target's tag group memberships onto it, which happens to satisfy the "belongs to no tag group" condition the ungrouped list is built from. Non-admins were shielded by a second accident, since a synonym normally ends up with a zero topic count — so any synonym that kept its topics, whether from an import, a plugin, or assigning `target_tag_id` directly, was listed to everyone. Tag visibility has two independent mechanisms: tag group permissions, and the categories a tag is attached to. Only the second one can apply to a tag that belongs to no tag group, and neither the grouped tags page nor the tag group search endpoint applied it, so the names of tags restricted to a category the viewer cannot read were listed to them. `TagGroup.visible` gates which groups are returned, never the tags inside them. The navigation menu tag picker filtered out neither synonyms nor tags only used in personal messages, and gated on staff where the tags page gates on admin, so moderators were served the entire tag table. A synonym picked there was saved as a sidebar link and rendered from then on. Top tags and tag search had the same gap. Paths that resolve a tag by name keep matching synonyms on purpose: the composer offers them so that typing a retired name finds the tag that replaced it, and hashtags in posts cooked before a rename have to keep working. Serializers that echo configuration back are left alone, because filtering a value the client posts straight back would silently delete it. |
||
|---|---|---|
| .. | ||
| admin | ||
| api | ||
| examples | ||
| about_controller_spec.rb | ||
| access_control_lists_controller_spec.rb | ||
| anonymous_actions_controller_spec.rb | ||
| application_controller_spec.rb | ||
| associate_accounts_controller_spec.rb | ||
| badges_controller_spec.rb | ||
| bookmarks_controller_spec.rb | ||
| calendar_subscriptions_controller_spec.rb | ||
| categories_controller_spec.rb | ||
| clicks_controller_spec.rb | ||
| composer_controller_spec.rb | ||
| composer_messages_controller_spec.rb | ||
| crawler_hreflang_spec.rb | ||
| default_headers_spec.rb | ||
| dev_mode_controller_spec.rb | ||
| directory_columns_controller_spec.rb | ||
| directory_items_controller_spec.rb | ||
| discourse_id_controller_spec.rb | ||
| do_not_disturb_controller_spec.rb | ||
| drafts_controller_spec.rb | ||
| edit_directory_columns_controller_spec.rb | ||
| email_controller_spec.rb | ||
| embed_controller_spec.rb | ||
| emojis_controller_spec.rb | ||
| exceptions_controller_spec.rb | ||
| export_csv_controller_spec.rb | ||
| extra_locales_controller_spec.rb | ||
| finish_installation_controller_spec.rb | ||
| form_templates_controller_spec.rb | ||
| forums_controller_spec.rb | ||
| gifs_controller_spec.rb | ||
| groups_controller_spec.rb | ||
| hashtags_controller_spec.rb | ||
| highlightjs_controller_spec.rb | ||
| home_page_controller_spec.rb | ||
| inline_onebox_controller_spec.rb | ||
| invites_controller_spec.rb | ||
| list_controller_spec.rb | ||
| metadata_controller_spec.rb | ||
| nested_topics_controller_spec.rb | ||
| net_http_header_spec.rb | ||
| net_http_timeout_spec.rb | ||
| noscript_escape_spec.rb | ||
| notifications_controller_spec.rb | ||
| offline_controller_spec.rb | ||
| omniauth_callbacks_controller_spec.rb | ||
| onebox_controller_spec.rb | ||
| permalinks_controller_spec.rb | ||
| post_action_users_controller_spec.rb | ||
| post_actions_controller_spec.rb | ||
| post_localizations_controller_spec.rb | ||
| post_readers_controller_spec.rb | ||
| posts_controller_spec.rb | ||
| presence_controller_spec.rb | ||
| published_pages_controller_spec.rb | ||
| push_notification_controller_spec.rb | ||
| qunit_controller_spec.rb | ||
| reviewable_claimed_topics_controller_spec.rb | ||
| reviewable_notes_controller_spec.rb | ||
| reviewables_controller_spec.rb | ||
| robots_txt_controller_spec.rb | ||
| safe_mode_controller_spec.rb | ||
| search_controller_spec.rb | ||
| session_controller_spec.rb | ||
| sidebar_sections_controller_spec.rb | ||
| similar_topics_controller_spec.rb | ||
| site_controller_spec.rb | ||
| sitemap_controller_spec.rb | ||
| slugs_controller_spec.rb | ||
| static_controller_spec.rb | ||
| steps_controller_spec.rb | ||
| stylesheets_controller_spec.rb | ||
| svg_sprite_controller_spec.rb | ||
| tag_groups_controller_spec.rb | ||
| tag_localizations_controller_spec.rb | ||
| tags_controller_spec.rb | ||
| theme_import_map_spec.rb | ||
| theme_javascripts_controller_spec.rb | ||
| topic_localizations_controller_spec.rb | ||
| topic_view_stats_controller_spec.rb | ||
| topics_controller_spec.rb | ||
| uploads_controller_multisite_spec.rb | ||
| uploads_controller_spec.rb | ||
| user_actions_controller_spec.rb | ||
| user_api_key_clients_controller_spec.rb | ||
| user_api_keys_controller_spec.rb | ||
| user_avatars_controller_spec.rb | ||
| user_badges_controller_spec.rb | ||
| user_status_controller_spec.rb | ||
| users_controller_spec.rb | ||
| users_email_controller_spec.rb | ||
| webhooks_controller_spec.rb | ||
| wizard_controller_spec.rb | ||
