discourse/app/serializers/user_post_bookmark_serializer.rb
Sam 05e03eab29
FIX: Bookmarked hidden post excerpts leak to unauthorized bookmark owners (#39873)
In rare occasions bookmarks can be made on spam posts that become
hidden. In that case go ahead and hide the excerpts from the bookmark
page.

---------

Co-authored-by: discourse-patch-triage[bot] <272280883+discourse-patch-triage[bot]@users.noreply.github.com>
Co-authored-by: Gabriel Grubba <70247653+Grubba27@users.noreply.github.com>
2026-05-15 14:04:05 +10:00

51 lines
789 B
Ruby
Vendored

# frozen_string_literal: true
class UserPostBookmarkSerializer < UserPostTopicBookmarkBaseSerializer
def post_id
post.id
end
def linked_post_number
post.post_number
end
def deleted
topic.deleted_at.present? || post.deleted_at.present?
end
def hidden
post.hidden
end
def raw
post.raw
end
def cooked
post.cooked
end
def post_item_excerpt_post
post
end
def bookmarkable_user
@bookmarkable_user ||= post.user
end
# NOTE: In the UI there are special topic-status and topic-link components to
# display the topic URL, this is only used for certain routes like the .ics bookmarks.
def bookmarkable_url
post.full_url
end
private
def topic
post.topic
end
def post
object.bookmarkable
end
end