mirror of
https://github.com/discourse/discourse.git
synced 2026-08-09 21:45:25 +08:00
e8669040d1
The `create_policy_allowed_groups` setting controls who can create policies, but it only gates the composer UI and the `post_process_cooked` event handler. It does not prevent unauthorized users from injecting `[policy]` markup directly into post raw — for example, by editing a wiki post. Add `DiscoursePolicy::PostValidator` as an ActiveRecord validation on `Post`. When policies are added, removed, or modified, both the post owner and the acting user must belong to `create_policy_allowed_groups` or the save is rejected. Policies inside blockquotes are ignored. |
||
|---|---|---|
| .. | ||
| locales | ||
| routes.rb | ||
| settings.yml | ||
