discourse-akismet/serializers/reviewable_akismet_user_serializer.rb
Isaac Janzen a88227e75b
Some checks failed
Discourse Plugin / ci (push) Has been cancelled
FIX: Ensure valid permissions to view email in Akismet reviewable (#219)
## Summary

Moderators did not respect the `moderators_view_emails` site setting allowing them to view user email addresses by viewing Akismet user reviews in the review queue.

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/1223

Co-authored-by: discourse-patch-triage <272280883+discourse-patch-triage[bot]@users.noreply.github.com>
2026-06-16 13:23:10 -05:00

31 lines
590 B
Ruby

# frozen_string_literal: true
require_dependency "reviewable_serializer"
class ReviewableAkismetUserSerializer < ReviewableSerializer
payload_attributes :username, :name, :email, :bio, :external_error
attributes :user_deleted, :link_admin
def created_from_flag?
true
end
def attributes(*args)
data = super
data[:payload]&.delete("email") if !include_email?
data
end
def include_email?
scope.can_check_emails?(scope.user)
end
def user_deleted
object.target.nil?
end
def link_admin
scope.is_staff? && object.target.present?
end
end