main ← fix/disagree-flag-unhide-acting-user
opened 05:20PM - 21 May 26 UTC
When a moderator disagreed with a flag on a hidden post, `Post#unhide!` re-ran `…PostValidator` against `acting_user`, which defaults to the post's author. If the author had since lost trust (e.g. demoted to TL0) and the post's content exceeded new-user limits (embedded media, links, mentions, host spam), the update failed with `ActiveRecord::RecordInvalid` and the post stayed hidden.
Every other internal caller of `Post#unhide!` already sets `acting_user` to whoever is performing the action so validations run against the staff member, not the original poster — `PostsController#unhide`, `ReviewablePost#perform_approve_and_unhide`, `ReviewableActionBuilder#perform_unhide_post`, and `PostActionDestroyer`. `ReviewableFlaggedPost#perform_disagree` was the lone exception.
Set `post.acting_user = performed_by` before calling `post.unhide!` to follow the established convention. The post content and ownership are untouched; this only affects which user the validator inspects during the update.
https://meta.discourse.org/t/401900
将通过以下链接修复