dtext links: fix links from mod-only forum posts being exposed.
Fix links from mod-only forum posts being publicly visible in the /dtext_links page.
This commit is contained in:
@@ -11,6 +11,12 @@ class DtextLink < ApplicationRecord
|
|||||||
scope :wiki_page, -> { where(model_type: "WikiPage") }
|
scope :wiki_page, -> { where(model_type: "WikiPage") }
|
||||||
scope :forum_post, -> { where(model_type: "ForumPost") }
|
scope :forum_post, -> { where(model_type: "ForumPost") }
|
||||||
|
|
||||||
|
def self.visible(user)
|
||||||
|
# XXX the double negation is to prevent postgres from choosing a bad query
|
||||||
|
# plan (it doesn't know that most forum posts aren't mod-only posts).
|
||||||
|
wiki_page.or(forum_post.where.not(model_id: ForumPost.not_visible(user)))
|
||||||
|
end
|
||||||
|
|
||||||
def self.model_types
|
def self.model_types
|
||||||
%w[WikiPage ForumPost]
|
%w[WikiPage ForumPost]
|
||||||
end
|
end
|
||||||
|
|||||||
@@ -40,6 +40,10 @@ class ForumPost < ApplicationRecord
|
|||||||
where(topic_id: ForumTopic.visible(user))
|
where(topic_id: ForumTopic.visible(user))
|
||||||
end
|
end
|
||||||
|
|
||||||
|
def not_visible(user)
|
||||||
|
where.not(topic_id: ForumTopic.visible(user))
|
||||||
|
end
|
||||||
|
|
||||||
def wiki_link_matches(title)
|
def wiki_link_matches(title)
|
||||||
where(id: DtextLink.forum_post.wiki_link.where(link_target: WikiPage.normalize_title(title)).select(:model_id))
|
where(id: DtextLink.forum_post.wiki_link.where(link_target: WikiPage.normalize_title(title)).select(:model_id))
|
||||||
end
|
end
|
||||||
|
|||||||
Reference in New Issue
Block a user