IntenseWebs/discourse
3
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2024-11-26 02:40:53 -06:00
Code Issues Packages Projects Releases Wiki Activity

FIX: TL3 can convert their post to a wiki (#25023)

Browse Source 
A bug that allowed TL1 to convert other's posts to wiki.

The issue was introduced in this PR: https://github.com/discourse/discourse/pull/24999/files

The wiki can be created if a user is TL3 and it is their own post - default 3 for setting `SiteSetting.min_trust_to_allow_self_wiki`

In addition, a wiki can be created by staff and TL4 users for any post.
This commit is contained in:
Krzysztof Kotlarek 2023-12-23 21:31:46 +11:00 committed by GitHub
parent c4f940aa31
commit d03f6727b1
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 1 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
lib/guardian/post_guardian.rb
View File

@ -330,7 +330,7 @@ module PostGuardian
def can_wiki?(post) def can_wiki?(post)
return false unless authenticated? return false unless authenticated?
return true if is_staff? || @user.in_any_groups?(SiteSetting.edit_wiki_post_allowed_groups_map) return true if is_staff? || @user.has_trust_level?(TrustLevel[4])
if @user.has_trust_level?(SiteSetting.min_trust_to_allow_self_wiki) && is_my_own?(post) if @user.has_trust_level?(SiteSetting.min_trust_to_allow_self_wiki) && is_my_own?(post)
return false if post.hidden? return false if post.hidden?

2
spec/lib/guardian_spec.rb
View File

@ -3639,8 +3639,6 @@ RSpec.describe Guardian do
describe "can_wiki?" do describe "can_wiki?" do
let(:post) { Fabricate(:post, created_at: 1.minute.ago) } let(:post) { Fabricate(:post, created_at: 1.minute.ago) }
before { SiteSetting.edit_wiki_post_allowed_groups = "14" }
it "returns false for regular user" do it "returns false for regular user" do
expect(Guardian.new(coding_horror).can_wiki?(post)).to be_falsey expect(Guardian.new(coding_horror).can_wiki?(post)).to be_falsey
end end

1
spec/requests/posts_controller_spec.rb
View File

@ -709,7 +709,6 @@ RSpec.describe PostsController do
end end
it "raises an error if the user doesn't have permission to wiki the post" do it "raises an error if the user doesn't have permission to wiki the post" do
SiteSetting.edit_wiki_post_allowed_groups = "14"
put "/posts/#{post.id}/wiki.json", params: { wiki: "true" } put "/posts/#{post.id}/wiki.json", params: { wiki: "true" }
expect(response).to be_forbidden expect(response).to be_forbidden
end end