Fix #5237: Deleted comments can be viewed by other users
* Fix it so non-moderators can't search deleted comments using the `updater`, `body`, `score`, `do_not_bump_post`, or `is_sticky` fields. Searching for these fields will exclude deleted comments. * Fix it so non-moderators can search for their own deleted comments using the `creator` field, but not for deleted comments belonging to other users. * Fix it so that if a regular user searches `commenter:<username>`, they can only see posts with undeleted comments by that user. If a moderator or the commenter themselves searches `commenter:<username>`, they can see all posts the user has commented on, including posts with deleted comments. * Fix it so the comment count on user profiles only counts visible comments. Regular users can only see the number of undeleted comments a user has, while moderators and the commenter themselves can see the total number of comments. Known issue: * It's still possible to order deleted comments by score, which can let you infer the score of deleted comments.
This commit is contained in:
@@ -44,6 +44,10 @@ class ApplicationRecord < ActiveRecord::Base
|
||||
all
|
||||
end
|
||||
|
||||
def visible_for_search(attribute, current_user)
|
||||
policy(current_user).visible_for_search(all, attribute)
|
||||
end
|
||||
|
||||
def policy(current_user)
|
||||
Pundit.policy(current_user, self)
|
||||
end
|
||||
|
||||
Reference in New Issue
Block a user