mirror of
https://github.com/discourse/discourse.git
synced 2026-08-07 13:19:19 +08:00
2c3ac01ed8Backport of #41176 to `release/2026.1`. --- Add `ensure_can_see_group` to the discourse-assign paths that resolve a group by user-supplied name before returning group metadata (`AssignController#assign`, `AssignController#group_members`, `ListController#group_topics_assigned`). Also guard the `assigned:<name>` search `advanced_filter` with `.visible_groups(@guardian.user).members_visible_groups(@guardian.user)` so a hidden group name resolves to a no-op instead of leaking the group's assigned topics. ### Backport notes The automated cherry-pick failed with a conflict in `spec/requests/list_controller_spec.rb`. The conflict was purely cosmetic — the original commit also carried an incidental `doesnt` → `doesn't` typo fix on the line adjacent to the new test. Resolved minimally: kept `release/2026.1`'s existing wording and only added the new `returns 403 for a group hidden from the acting user` test. All four code/spec hunks otherwise applied cleanly, and the required core helpers (`can_see_group?`, `visible_groups`/`members_visible_groups`) already exist on `release/2026.1`. Includes the search-spec stabilization from #41176 so the new test isn't order/limit dependent. --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| components | ||
| fabricators | ||
| integration | ||
| jobs | ||
| lib | ||
| models | ||
| requests | ||
| serializers | ||
| support | ||
| system | ||
| plugin_spec.rb | ||
