I would like to allow regular users to trigger certain events (create annotation, likes, votes) on a given topic whereby the topic timestamp is updated. I noticed that the POST /t/:topic_id/change-timestamp request returns a 403 (Forbidden) whereas if I am logged in as admin it works just fine. What should I do in order to allow the timestamp of a topic to be updated by non-admin folks?

That is ultra admin functionality. I am not sure I even want a site setting for “min trust level to muck with timestamps” I guess best I can thing of is to make sure that there is a discrete function in guardian and monkey patch that in a plugin. Then add tests to your plugin to ensure nothing regresses long term.

Please explain in more detail how to monkey patch the guardian functionality.

Not sure where to start, are you a developer? How is your Ruby? Can you write Discourse plugins?

I’m monkey patching the Guardian class in Babble here: class ::Guardian module CanSeeTopic def can_see_topic?(topic) super || some_other_condition end end prepend CanSeeTopic end Module#prepend is a little opaque, but in short it allows you to invoke the ‘original’ function of the class with super. Then you can add additional checks to the function to suit your needs. If you don’t care about what the original functionality is, you can also simply wipe the original implementation like so: class ::Guardian def can_see_topic?(topic) false # no topics for anyone! 😈 end end Note that this is a little bit riskier because the original implementation may change without you knowing it.

Okay thanks, this is more clear now. However, I cannot find a comparable guardian method for can_change_timestamp so how do I implement that?

Looks like it uses the can_change_post_owner? permission.

So how then would I implement this ONLY when changing the timestamp and NOT otherwise?

Sorry, I’ve hit the limit of my free tier ¯\(ツ)/¯ You’ll have to patch together the existing methods somehow so it either uses another permission that you define, or that the existing permission is smart enough to know when it’s changing a timestamp and when it’s doing other stuff.

No problem, see pull request #4538 Thanks for using up your free tier helping me, hopefully now I can give back in thanks to the community.

Change topic timestamp results in 403 (Forbidden)

Development

kgish (Kgish) 2016 年11 月 3 日 23:29 5

I’m a hardcore developer making my own plugin using ruby, javascript and ember. So feel free to hit me as hard as you want with low-level details, I can handle it.

话题		回复	浏览量
Allow moderators to change topic timestamp Feature	2	1192	2019 年2 月 22 日
Change Timestamp only for admin? Bug	4	1376	2017 年3 月 15 日
How to customize / override topic guardian through a plugin Development	4	864	2021 年2 月 15 日
How to change topic timestamps? Product Support	3	280	2025 年11 月 7 日
Guardian before and after checks api Development	4	372	2024 年7 月 29 日

Change topic timestamp results in 403 (Forbidden)

相关话题