mirror of
https://gh.wpcy.net/https://github.com/discourse/discourse.git
synced 2026-05-26 23:09:13 +08:00
746000edc8
Same-IP user lookups now identify the target by user_id and ip_type rather than accepting a raw IP in params, so the IP is resolved server-side and never round-trips through clients that lack permission to see it. Additionally: - Hide the `suspicious_logins` report (list, bulk, show, CSV export and the security dashboard tile) from non-admin staff lacking `can_see_ip?`. - Hide the IP column and CSV export button on the screened emails page from staff lacking `can_see_ip?`. - Omit `ip_address` from `ScreenedUrlSerializer` for staff lacking `can_see_ip?`. - Require `can_see_ip?` (in addition to `can_see_emails?`) to export the `screened_email` entity. - Record the username (not the IP) in the staff-log context for "delete other accounts with same IP" when the acting user lacks `can_see_ip?`.
62 lines
1.5 KiB
Ruby
Vendored
62 lines
1.5 KiB
Ruby
Vendored
# frozen_string_literal: true
|
|
|
|
module Admin
|
|
module Search
|
|
class List
|
|
include Service::Base
|
|
|
|
RESULT_FILTER_STATUSES = %w[experimental alpha beta stable].freeze
|
|
|
|
params do
|
|
attribute :filter_names, :array
|
|
attribute :filter_area, :string
|
|
attribute :plugin, :string
|
|
attribute :categories, :array
|
|
|
|
def include_locale_setting?
|
|
filter_area.blank? || filter_area == "localization"
|
|
end
|
|
end
|
|
|
|
policy :current_user_is_admin
|
|
model :settings
|
|
model :themes_and_components
|
|
model :reports
|
|
model :upcoming_changes
|
|
|
|
private
|
|
|
|
def current_user_is_admin(guardian:)
|
|
guardian.is_admin?
|
|
end
|
|
|
|
def fetch_settings(params:)
|
|
SiteSetting.all_settings(
|
|
filter_names: params.filter_names,
|
|
filter_area: params.filter_area,
|
|
filter_plugin: params.plugin,
|
|
filter_categories: params.categories,
|
|
include_locale_setting: params.include_locale_setting?,
|
|
basic_attributes: true,
|
|
)
|
|
end
|
|
|
|
def fetch_themes_and_components(guardian:)
|
|
Theme.all.order(:name).to_a
|
|
end
|
|
|
|
def fetch_reports(guardian:)
|
|
Reports::ListQuery.call(guardian: guardian)
|
|
end
|
|
|
|
def fetch_upcoming_changes(guardian:)
|
|
UpcomingChanges::List.call(
|
|
guardian:,
|
|
options: {
|
|
filter_statuses: RESULT_FILTER_STATUSES,
|
|
},
|
|
).upcoming_changes
|
|
end
|
|
end
|
|
end
|
|
end
|
