mirror of
https://gh.wpcy.net/https://github.com/discourse/discourse.git
synced 2026-05-01 14:54:42 +08:00
d74ff25db9
## Summary - Adds a `guardian.can_see_topic?` check in `DiscoursePoll::Poll` to prevent users from interacting with polls on topics they can no longer access - Covers the case where a user loses group membership for a private category but could still toggle poll status via the API - Adds integration test verifying poll toggle is blocked after group removal --- **Security Advisory:** https://github.com/discourse/discourse/security/advisories/GHSA-wq58-pvf6-w4p8 |
||
|---|---|---|
| .. | ||
| poll | ||
| poll.rb | ||
| polls_updater.rb | ||
| polls_validator.rb | ||
| post_extension.rb | ||
| post_validator.rb | ||
| ranked_choice.rb | ||
| user_extension.rb | ||
