jaculabilis/danbooru
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Fix #5237: Deleted comments can be viewed by other users

Browse Source 
* Fix it so non-moderators can't search deleted comments using the
  `updater`, `body`, `score`, `do_not_bump_post`, or `is_sticky` fields.
  Searching for these fields will exclude deleted comments.

* Fix it so non-moderators can search for their own deleted comments using the
  `creator` field, but not for deleted comments belonging to other users.

* Fix it so that if a regular user searches `commenter:<username>`, they
  can only see posts with undeleted comments by that user. If a moderator or
  the commenter themselves searches `commenter:<username>`, they can see all
  posts the user has commented on, including posts with deleted comments.

* Fix it so the comment count on user profiles only counts visible
  comments. Regular users can only see the number of undeleted comments
  a user has, while moderators and the commenter themselves can see the
  total number of comments.

Known issue:

* It's still possible to order deleted comments by score, which can let
  you infer the score of deleted comments.
This commit is contained in:
evazion
2022-09-22 19:02:17 -05:00
parent 88ac91f5f3
commit a442658f8a
8 changed files with 88 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
app/policies/comment_policy.rb
View File

@@ -43,5 +43,16 @@ class CommentPolicy < ApplicationPolicy
attributes
end
def visible_for_search(comments, attribute)
case attribute
in :creator | :creator_id if !can_see_deleted?
comments.where(creator: user, is_deleted: true).or(comments.undeleted)
in :updater | :updater_id | :body | :score | :do_not_bump_post | :is_sticky if !can_see_deleted?
comments.undeleted
else
comments
end
end
alias_method :undelete?, :update?
end