Yoo Robert!
I have been analyzing plugin code and codebase about post controls (actions). To check which I could do the most about security.
As analyzed! By front-end there are some steps which make sure if user can edit or not the post, like:
- 1° step: SiteSetting.post_menu_hidden_items
- 2° step: attrs.canEdit
- 3° step: editPost() - !post.can_edit - controllers/topic
But, even if manipulated by front, one time sent to the back end server in posts_controller.rb, in
def update
It req again the post, by Rails, as a ultimate checks:
- !guardian.public_send(“can_edit?”, post)
- guardian.ensure_can_edit!(post)
- PostRevisor
Thank you for your insights!
That’s so great.