点击反应计数器时，若帖子被隐藏，会遇到 403 循环

贡献 错误
1

后端 /discourse-reactions/app/controllers/discourse_reactions/custom_reactions_controller.rb 使用 guardian.ensure_can_see!(post) 来限制无权限用户在帖子被隐藏时加载反应数据。

然而，前端仍会渲染反应计数器，因此当用户点击隐藏帖子的反应计数器时，会出现无限加载，并在请求 /discourse-reactions/posts/xxx/reactions-users-list.json 时返回 403 禁止访问错误。

本次提交在前端添加了类似的防护逻辑：当 args.post.hidden && !args.post.can_see_hidden_post 时隐藏反应计数器，从而解决该问题。

https://private-user-images.githubusercontent.com/77799160/595836870-87c39f7f-5b8b-4555-a877-fe74714e16ca.png?jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3ODAwMjM0OTEsIm5iZiI6MTc4MDAyMzE5MSwicGF0aCI6Ii83Nzc5OTE2MC81OTU4MzY4NzAtODdjMzlmN2YtNWI4Yi00NTU1LWE4NzctZmU3NDcxNGUxNmNhLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNjA1MjklMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjYwNTI5VDAyNTMxMVomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPWQ5NjZhYjYzODhhODk4N2ZkNjZjODgwNjRlY2Y5ZWI5ZDllN2RjMDBjNzhhMDMxNGM2NjJmNGYxMmNmODlkMzcmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JnJlc3BvbnNlLWNvbnRlbnQtdHlwZT1pbWFnZSUyRnBuZyJ9.Yt3iCEvZNcQmOXCn6kwviEAkLMe0efWZXkeohflv2Wg

PR: FIX: reactions shouldn't be visible to users without see_hidden_post permission if a post is hidden by small-lovely-cat · Pull Request #40216 · discourse/discourse · GitHub

4 个赞
2

谢谢！我刚刚已经合并了。

1 个赞