mirror of
https://gh.wpcy.net/https://github.com/discourse/discourse.git
synced 2026-05-26 21:18:34 +08:00
ea2971a5aa
This PR contains a few chat patches: - https://patch.discourse.org/patch-triage/1081 - Read-only category users could create chat threads via `Chat::CreateThread`. Tightened `can_create_thread_in_channel` to require `can_join_chat_channel?` for category channels and the full `Chat::Channel::Policy::MessageCreation` for DMs, plus a 403 handler for the failed policy. - `channel_threads_controller.rb`, `create_thread.rb`, `channel_threads_controller_spec.rb`, `create_thread_spec.rb` - https://patch.discourse.org/patch-triage/1086 - A user could restore their own self-deleted chat message after losing access to the channel (group revoked, DM membership removed). Added a `can_preview_chat_channel?` short-circuit inside the self-deletion branch of `can_restore_chat?`. - `guardian_extensions.rb`, `guardian_extensions_spec.rb`, `channel_messages_controller_spec.rb` - https://patch.discourse.org/patch-triage/1049 - Reviewable chat messages exposed unrelated current `last_message` content of a flagged DM channel to moderators (who aren't members). Added an `include_last_message?` predicate on `Chat::ChannelSerializer` gated by `can_preview_chat_channel?`, which is false for DM non-members but stays true for read-only category members so they keep seeing channel previews. - `channel_serializer.rb`, `channel_serializer_spec.rb`, `reviewables_controller_spec.rb` - https://patch.discourse.org/patch-triage/1047 + https://patch.discourse.org/patch-triage/1053 - The calendar event API leaked the chat channel block (and its `last_message` body) to anonymous viewers and any user without chat access. Gated `include_channel?` with `can_chat? && can_preview_chat_channel?` (excludes anonymous and users not in `chat_allowed_groups`, while preserving read-only category access) and passed membership through to the channel serializer. - `discourse-calendar/app/serializers/discourse_post_event/event_serializer.rb`, `discourse-calendar/spec/requests/events_controller_spec.rb` https://github.com/discourse/discourse/security/advisories/GHSA-rw8j-p2gv-q33w
54 lines
1.7 KiB
Ruby
Vendored
54 lines
1.7 KiB
Ruby
Vendored
# frozen_string_literal: true
|
|
|
|
RSpec.describe ReviewablesController do
|
|
fab!(:moderator)
|
|
fab!(:message_author) { Fabricate(:user, refresh_auto_groups: true) }
|
|
fab!(:flagger) { Fabricate(:user, refresh_auto_groups: true) }
|
|
fab!(:direct_message_channel) do
|
|
Fabricate(:direct_message_channel, users: [message_author, flagger])
|
|
end
|
|
|
|
before do
|
|
SiteSetting.chat_enabled = true
|
|
SiteSetting.chat_allowed_groups = Group::AUTO_GROUPS[:everyone]
|
|
SiteSetting.chat_message_flag_allowed_groups = Group::AUTO_GROUPS[:everyone]
|
|
end
|
|
|
|
describe "#index" do
|
|
it "does not expose unrelated direct-message last message content to moderators" do
|
|
flagged_message_text = "flagged direct message content"
|
|
unrelated_last_message_text = "unrelated later direct message secret"
|
|
flagged_message =
|
|
Fabricate(
|
|
:chat_message,
|
|
chat_channel: direct_message_channel,
|
|
user: message_author,
|
|
message: flagged_message_text,
|
|
)
|
|
|
|
result =
|
|
Chat::ReviewQueue.new.flag_message(
|
|
flagged_message,
|
|
Guardian.new(flagger),
|
|
ReviewableScore.types[:spam],
|
|
)
|
|
expect(result[:success]).to eq(true)
|
|
|
|
unrelated_last_message =
|
|
Fabricate(
|
|
:chat_message,
|
|
chat_channel: direct_message_channel,
|
|
user: flagger,
|
|
message: unrelated_last_message_text,
|
|
)
|
|
direct_message_channel.update!(last_message: unrelated_last_message)
|
|
|
|
sign_in(moderator)
|
|
get "/review.json", params: { type: "Chat::ReviewableMessage" }
|
|
|
|
expect(response.status).to eq(200)
|
|
expect(response.body).to include(flagged_message_text)
|
|
expect(response.body).not_to include(unrelated_last_message_text)
|
|
end
|
|
end
|
|
end
|
