mirror of
https://github.com/discourse/discourse.git
synced 2026-08-06 00:15:24 +08:00
2c3ac01ed8Backport of #41176 to `release/2026.1`. --- Add `ensure_can_see_group` to the discourse-assign paths that resolve a group by user-supplied name before returning group metadata (`AssignController#assign`, `AssignController#group_members`, `ListController#group_topics_assigned`). Also guard the `assigned:<name>` search `advanced_filter` with `.visible_groups(@guardian.user).members_visible_groups(@guardian.user)` so a hidden group name resolves to a no-op instead of leaking the group's assigned topics. ### Backport notes The automated cherry-pick failed with a conflict in `spec/requests/list_controller_spec.rb`. The conflict was purely cosmetic — the original commit also carried an incidental `doesnt` → `doesn't` typo fix on the line adjacent to the new test. Resolved minimally: kept `release/2026.1`'s existing wording and only added the new `returns 403 for a group hidden from the acting user` test. All four code/spec hunks otherwise applied cleanly, and the required core helpers (`can_see_group?`, `visible_groups`/`members_visible_groups`) already exist on `release/2026.1`. Includes the search-spec stabilization from #41176 so the new test isn't order/limit dependent. --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| app | ||
| assets | ||
| config | ||
| db/migrate | ||
| lib | ||
| spec | ||
| svg-icons | ||
| test/javascripts | ||
| package.json | ||
| plugin.rb | ||
| README.md | ||
| tsconfig.json | ||
Assign Plugin
Allows you to assign topics and individual posts (both private and public) to a user or group.
For more information, please see: https://meta.discourse.org/t/discourse-assign/58044
