discourse-solved/config/settings.yml
Osama Sayegh 77c07edf82
FIX: Don't allow TL4 users to unconditionally accept solutions (#305)
A while ago the `accept_all_solutions_allowed_groups` setting was introduced to replace the `accept_all_solutions_trust_level` setting and to make the plugin more flexible by allowing admins to choose groups that are allowed to accept solutions instead of trust levels.

The new group-based setting includes the TL4 group by default. However, removing the TL4 group from the setting doesn't actually remove TL4 users permission to accept solution.

The reason for this bug is that the `can_accept_answer?` guardian method calls `can_perform_action_available_to_group_moderators?` which always allows TL4 users to perform category moderator actions:

56524f4bdf/lib/guardian/topic_guardian.rb (L342-L348)

This commit fixes the bug by checking if the user is a moderator on the topic's category (by calling the `is_category_group_moderator?` guardian method) instead of checking if the user can perform category moderator actions. In our case, `is_category_group_moderator?` is equivalent to `can_perform_action_available_to_group_moderators?` except for the TL4 check which is what we need.

Internal topic: t/134675.
2024-08-09 14:59:28 +03:00

59 lines
1.4 KiB
YAML

discourse_solved:
solved_enabled:
default: true
client: true
allow_solved_on_all_topics:
default: false
client: true
accept_all_solutions_trust_level:
default: 4
client: true
enum: "TrustLevelSetting"
hidden: true
accept_all_solutions_allowed_groups:
default: "1|2|14" # auto group admin, moderators and trust_level_4
mandatory_values: "1|2" # auto group admins, moderators
type: group_list
client: false
allow_any: false
refresh: true
validator: "AtLeastOneGroupValidator"
empty_box_on_unsolved:
default: false
client: true
solved_quote_length:
default: 300
client: false
solved_topics_auto_close_hours:
default: 0
min: 0
max: 175200 # 20 years
show_filter_by_solved_status:
default: false
client: true
notify_on_staff_accept_solved:
default: false
ignore_solved_topics_in_assigned_reminder:
default: false
assignment_status_on_solve:
type: string
default: ""
assignment_status_on_unsolve:
type: string
default: ""
disable_solved_education_message:
default: false
accept_solutions_topic_author:
default: true
solved_add_schema_markup:
type: enum
default: "always"
choices:
- "never"
- "always"
- "answered only"
prioritize_solved_topics_in_search: false
enable_solved_tags:
type: tag_list
default: ""