FIX: Return 422 when creating topics with tags w/out permission (#10400)

The UI prevents users from trying to create tags on topics when they
don't have permission, but if you are trying to add tags to a topic via
the API and you don't have permission before this change it would
silently succeed in creating the topic, but it wouldn't have any tags.

Now a 422 error will be returned with an error message when trying to
create a topic with tags when tagging is disabled or you don't have
enough trust level to add tags to a topic.

Bug report: https://meta.discourse.org/t/-/70525/14
This commit is contained in:
Blake Erickson
2020-08-10 16:14:15 -06:00
committed by GitHub
parent 1972364d0f
commit 2032c11f78
7 changed files with 65 additions and 6 deletions

View File

@@ -78,7 +78,7 @@ module DiscourseTagging
parent_tags_map = DB.query("
SELECT tgm.tag_id, tg.parent_tag_id
FROM tag_groups tg
INNER JOIN tag_group_memberships tgm
INNER JOIN tag_group_memberships tgm
ON tgm.tag_group_id = tg.id
WHERE tg.parent_tag_id IS NOT NULL
AND tgm.tag_id IN (?)
@@ -112,8 +112,9 @@ module DiscourseTagging
topic.tags = []
end
topic.tags_changed = true
return true
end
true
false
end
def self.validate_min_required_tags_for_category(guardian, topic, category, tags = [])

View File

@@ -165,7 +165,10 @@ class TopicCreator
end
else
valid_tags = DiscourseTagging.tag_topic_by_names(topic, @guardian, @opts[:tags])
rollback_from_errors!(topic) unless valid_tags
unless valid_tags
topic.errors.add(:base, :unable_to_tag)
rollback_from_errors!(topic)
end
end
end