SECURITY: Restrict display of topic titles associated with user badges (#18768)

Before this commit, we did not have guardian checks in place to determine if a
topic's title associated with a user badge should be displayed or not.
This means that the topic title of topics with restricted access
could be leaked to anon and users without access if certain conditions
are met. While we will not specify the conditions required, we have internally
assessed that the odds of meeting such conditions are low.

With this commit, we will now apply a guardian check to ensure that the
current user is able to see a topic before the topic's title is included
in the serialized object of a `UserBadge`.
This commit is contained in:
Alan Guo Xiang Tan
2022-10-27 11:26:14 +08:00
committed by GitHub
parent 1b56a55f50
commit 101ec21bc9
8 changed files with 325 additions and 14 deletions

View File

@@ -1,27 +1,34 @@
# frozen_string_literal: true
class DetailedUserBadgeSerializer < BasicUserBadgeSerializer
include UserBadgePostAndTopicAttributesMixin
has_one :granted_by, serializer: UserBadgeSerializer::UserSerializer
attributes :post_number, :topic_id, :topic_title, :is_favorite, :can_favorite
def include_post_number?
object.post
def post_number
object.post.post_number
end
alias :include_topic_id? :include_post_number?
alias :include_topic_title? :include_post_number?
def post_number
object.post.post_number if object.post
def include_post_number?
include_post_attributes?
end
def topic_id
object.post.topic_id if object.post
object.post.topic_id
end
def include_topic_id?
include_topic_attributes?
end
def topic_title
object.post.topic.title if object.post && object.post.topic
object.post.topic.title
end
def include_topic_title?
include_topic_id?
end
def can_favorite