IntenseWebs/discourse
3
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2025-02-25 18:55:32 -06:00
Code Issues Packages Projects Releases Wiki Activity

SECURITY: Do not leak private group names. (#7008)

Browse Source
This commit is contained in:
Bianca Nenciu
2019-02-14 16:35:58 +02:00
committed by Régis Hanol
parent b5fbd7385f
commit 70adb94008
3 changed files with 22 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
app/models/site.rb
View File

@@ -71,6 +71,12 @@ class Site
end
end
def groups
groups = Group.visible_groups(@guardian.user)
groups = groups.where("automatic IS FALSE OR groups.id = #{Group::AUTO_GROUPS[:moderators]}") if !@guardian.is_staff?
groups
end
def suppressed_from_latest_category_ids
categories.select { |c| c.suppress_from_latest == true }.map(&:id)
end