Discourse 中的徽章系统

[robmc (Robert McIntosh)]

You can read about this here:

Enable Badge SQL

Enabling Badge SQL entails security and performance risks. Starting from Discourse 1.6 badge SQL can no longer be edited by admins unless explicitly enabled. This change was made for a couple of reasons: Security: Allowing admins to enter SQL directly grants them raw access to the database. Generally, we opt that raw access to the database from the web UI as a feature you opt-in for. Even though the queries only return user_ids, an admin attacker can discover any information in …