0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-04 10:39:43 +08:00
discourse/lib/post_action_destroyer.rb
Isaac Janzen a6e2ca8d53
FIX: Prevent Flag Score Inflation in PostAction (#42233)
## Summary

Prevent unauthorized post hiding by removing pending reviewable scores
when a flag is withdrawn. This ensures that repeated flagging and
retracting by a single user cannot inflate a post's score to reach the
auto-hide threshold.

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/1329

Co-authored-by: discourse-patch-triage
<272280883+discourse-patch-triage[bot]@users.noreply.github.com>
2026-07-31 13:34:17 -05:00

120 lines
3 KiB
Ruby
Vendored

# frozen_string_literal: true
class PostActionDestroyer
class DestroyResult < PostActionResult
attr_accessor :post
end
def initialize(destroyed_by, post, post_action_type_id, opts = {})
@destroyed_by, @post, @post_action_type_id, @opts =
destroyed_by,
post,
post_action_type_id,
opts
end
def self.destroy(destroyed_by, post, action_key, opts = {})
new(destroyed_by, post, PostActionType.types[action_key], opts).perform
end
def post_action_type_view
@post_action_type_view ||= PostActionTypeView.new
end
def perform
result = DestroyResult.new
if @post.blank?
result.not_found = true
return result
end
finder =
PostAction.where(user: @destroyed_by, post: @post, post_action_type_id: @post_action_type_id)
finder = finder.with_deleted if @destroyed_by.staff?
post_action = finder.first
if post_action.blank?
result.not_found = true
return result
end
unless @opts[:skip_delete_check] == true || guardian.can_delete?(post_action)
result.forbidden = true
result.add_error(I18n.t("invalid_access"))
return result
end
RateLimiter.new(
@destroyed_by,
"post_action-#{@post.id}_#{@post_action_type_id}",
4,
1.minute,
).performed!
post_action.remove_act!(@destroyed_by)
remove_reviewable_score if post_action.is_flag?
if post_action.staff_took_action
post_action.post.acting_user = @destroyed_by
post_action.post.unhide!
end
if @post_action_type_id == post_action_type_view.types[:like]
GivenDailyLike.decrement_for(@destroyed_by.id)
end
case @post_action_type_id
when *post_action_type_view.notify_flag_type_ids
DiscourseEvent.trigger(:flag_destroyed, post_action, self)
when post_action_type_view.types[:like]
DiscourseEvent.trigger(:like_destroyed, post_action, self)
end
UserActionManager.post_action_destroyed(post_action)
PostActionNotifier.post_action_deleted(post_action)
result.success = true
result.post = @post.reload
notify_subscribers
result
end
protected
def self.notify_types
@notify_types ||= PostActionType.notify_flag_types.keys
end
def notify_subscribers
name = post_action_type_view.types[@post_action_type_id]
if name == :like
@post.publish_change_to_clients!(
:unliked,
{ likes_count: @post.like_count, user_id: @destroyed_by.id },
)
elsif self.class.notify_types.include?(name)
@post.publish_change_to_clients!(:acted)
end
end
def remove_reviewable_score
reviewable = @post.reviewable_flag
return if reviewable.blank?
deleted_count =
ReviewableScore
.pending
.where(
reviewable: reviewable,
user: @destroyed_by,
reviewable_score_type: @post_action_type_id,
)
.delete_all
reviewable.recalculate_score if deleted_count > 0
end
def guardian
@guardian ||= Guardian.new(@destroyed_by)
end
end