IntenseWebs/discourse
3
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2024-11-28 19:53:53 -06:00
Code Issues Packages Projects Releases Wiki Activity

SECURITY: only show user suggestions with regular post (#15436)

Browse Source
This commit is contained in:
Arpit Jalan 2022-01-03 13:37:40 +05:30 committed by GitHub
parent 494033225e
commit 702685b6a0
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 7 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
app/models/user_search.rb
View File

@ -83,7 +83,7 @@ class UserSearch
# 2. in topic
if @topic_id
in_topic = filtered_by_term_users
.where('users.id IN (SELECT user_id FROM posts WHERE topic_id = ?)', @topic_id)
.where('users.id IN (SELECT user_id FROM posts WHERE topic_id = ? AND post_type = ?)', @topic_id, Post.types[:regular])
if @searching_user.present?
in_topic = in_topic.where('users.id <> ?', @searching_user.id)

6
spec/models/user_search_spec.rb
View File

@ -114,6 +114,7 @@ describe UserSearch do
fab!(:post5) { Fabricate :post, user: mr_brown, topic: topic3 }
fab!(:post6) { Fabricate :post, user: mr_white, topic: topic }
fab!(:post7) { Fabricate :post, user: staged, topic: topic4 }
fab!(:post8) { Fabricate :post, user: mr_brown, topic: topic2, post_type: Post.types[:whisper] }
before { mr_white.update(suspended_at: 1.day.ago, suspended_till: 1.year.from_now) }
@ -170,6 +171,11 @@ describe UserSearch do
expect(results).to eq [mr_b, mr_brown, mr_blue].map(&:username)
end
it "does not reveal whisper users" do
results = search_for("", topic_id: topic2.id)
expect(results).to eq [mr_blue.username]
end
it "only reveals topic participants to people with permission" do
pm_topic = Fabricate(:private_message_post).topic