On review page tag restricted to the topic owner privileges

AI-generated summary

A bug has been discovered where the review page tag is restricted to the topic owner’s privileges. Don recreated the issue by setting a tag group to a different group than the reviewable topic’s owner, resulting in a warning modal and console error when attempting to approve the post.

The problem lies in the use of guardian permissions, which currently defaults to the topic owner’s permissions. To resolve this, vinothkannans suggests using the reviewer’s guardian instead, ensuring that permissions are checked correctly everywhere when creating posts/topics by approval. This fix is implemented in pull request #19710.

Hello,

If one of tag group settings :arrow_down_small:

Is set to a different group then the reviewable topic’s owner. Then the topic cannot be approved with that tag.


Repro:

  1. Turn on review every post site settings for testing.

  2. Create a tag group with a tag and set the Tags are visible only to the following groups e.g: staff

  3. Create a topic with a non staff user. I created with a TL1 user.

  4. Click edit and add the tag you created on the 2. point.

  5. Click Approve Post button.

It will show a warning modal.

And a console error.

It seems on review page it restricted to the topic owner privileges.

Thanks :slightly_smiling_face:

2 Likes
opts.merge!(guardian: Guardian.new(performed_by)) if performed_by.staff?

Now we will use reviewer’s “guardian” to check permissions everywhere while creating posts/topics by approval. I hope that is fine.

https://github.com/discourse/discourse/pull/19710

4 Likes