discourse/app/serializers/user_topic_bookmark_serializer.rb
Sam 05e03eab29
FIX: Bookmarked hidden post excerpts leak to unauthorized bookmark owners (#39873)
In rare occasions bookmarks can be made on spam posts that become
hidden. In that case go ahead and hide the excerpts from the bookmark
page.

---------

Co-authored-by: discourse-patch-triage[bot] <272280883+discourse-patch-triage[bot]@users.noreply.github.com>
Co-authored-by: Gabriel Grubba <70247653+Grubba27@users.noreply.github.com>
2026-05-15 14:04:05 +10:00

64 lines
1.3 KiB
Ruby
Vendored

# frozen_string_literal: true
class UserTopicBookmarkSerializer < UserPostTopicBookmarkBaseSerializer
attributes :last_read_post_number
# NOTE: It does not matter what the linked post number is for topic bookmarks,
# on the client we always take the user to the last unread post in the
# topic when the bookmark URL is clicked
def linked_post_number
1
end
def first_post
@first_post ||= topic.first_post
end
def deleted
topic.deleted_at.present? || first_post.deleted_at.present?
end
def hidden
first_post.hidden
end
def raw
first_post.raw
end
def cooked
first_post.cooked
end
def post_item_excerpt_post
first_post
end
def bookmarkable_user
@bookmarkable_user ||= first_post.user
end
# NOTE: In the UI there are special topic-status and topic-link components to
# display the topic URL, this is only used for certain routes like the .ics bookmarks.
def bookmarkable_url
if @options[:link_to_first_unread_post]
Topic.url(topic_id, slug, (last_read_post_number || 0) + 1)
else
topic.url
end
end
def last_read_post_number
topic_user&.last_read_post_number
end
private
def topic
object.bookmarkable
end
def topic_user
topic.user_data
end
end