From b283bb2ba7e714e7ea8598aa10a001d0c1018473 Mon Sep 17 00:00:00 2001
From: Robin Ward <robin.ward@gmail.com>
Date: Wed, 28 Feb 2018 14:39:11 -0500
Subject: [PATCH] FIX: Don't include unlisted topic in groups/posts

---
 app/models/group.rb       |  1 +
 spec/models/group_spec.rb | 19 +++++++++++++++++++
 2 files changed, 20 insertions(+)

diff --git a/app/models/group.rb b/app/models/group.rb
index ccdb0fe6511..6c542b9b6c4 100644
--- a/app/models/group.rb
+++ b/app/models/group.rb
@@ -192,6 +192,7 @@ class Group < ActiveRecord::Base
       .references(:posts, :topics, :category)
       .where(user_id: user_ids)
       .where('topics.archetype <> ?', Archetype.private_message)
+      .where('topics.visible')
       .where(post_type: Post.types[:regular])
 
     if opts[:category_id].present?
diff --git a/spec/models/group_spec.rb b/spec/models/group_spec.rb
index ee3faf189b2..20b1e242d14 100644
--- a/spec/models/group_spec.rb
+++ b/spec/models/group_spec.rb
@@ -5,6 +5,25 @@ describe Group do
   let(:user) { Fabricate(:user) }
   let(:group) { Fabricate(:group) }
 
+  describe "#posts_for" do
+    it "returns the post in the group" do
+      p = Fabricate(:post)
+      group.add(p.user)
+
+      posts = group.posts_for(Guardian.new)
+      expect(posts).to include(p)
+    end
+
+    it "doesn't include unlisted posts" do
+      p = Fabricate(:post)
+      p.topic.update_column(:visible, false)
+      group.add(p.user)
+
+      posts = group.posts_for(Guardian.new)
+      expect(posts).not_to include(p)
+    end
+  end
+
   describe '#builtin' do
     context "verify enum sequence" do
       before do