Change topic timestamp results in 403 (Forbidden)

dev
1

I would like to allow regular users to trigger certain events (create annotation, likes, votes) on a given topic whereby the topic timestamp is updated.

I noticed that the POST /t/:topic_id/change-timestamp request returns a 403 (Forbidden) whereas if I am logged in as admin it works just fine.

What should I do in order to allow the timestamp of a topic to be updated by non-admin folks?

2

That is ultra admin functionality. I am not sure I even want a site setting for ā€œmin trust level to muck with timestampsā€

I guess best I can thing of is to make sure that there is a discrete function in guardian and monkey patch that in a plugin. Then add tests to your plugin to ensure nothing regresses long term.

1 Like
3

Please explain in more detail how to monkey patch the guardian functionality.

4

Not sure where to start, are you a developer? How is your Ruby? Can you write Discourse plugins?

2 Likes
5

Iā€™m a hardcore developer making my own plugin using ruby, javascript and ember. So feel free to hit me as hard as you want with low-level details, I can handle it.

3 Likes
6

Iā€™m monkey patching the Guardian class in Babble here:

class ::Guardian
  module CanSeeTopic
    def can_see_topic?(topic)
      super || some_other_condition
    end
  end
  prepend CanSeeTopic
end

Module#prepend is a little opaque, but in short it allows you to invoke the ā€˜originalā€™ function of the class with super. Then you can add additional checks to the function to suit your needs.

If you donā€™t care about what the original functionality is, you can also simply wipe the original implementation like so:

class ::Guardian
  def can_see_topic?(topic)
    false # no topics for anyone! šŸ˜ˆ 
  end
end

Note that this is a little bit riskier because the original implementation may change without you knowing it.

3 Likes
7

Okay thanks, this is more clear now. However, I cannot find a comparable guardian method for can_change_timestamp so how do I implement that?

8

Looks like it uses the can_change_post_owner? permission.

9

So how then would I implement this ONLY when changing the timestamp and NOT otherwise?

10

Sorry, Iā€™ve hit the limit of my free tier ĀÆ\(惄)/ĀÆ

Youā€™ll have to patch together the existing methods somehow so it either uses another permission that you define, or that the existing permission is smart enough to know when itā€™s changing a timestamp and when itā€™s doing other stuff.

3 Likes
11

No problem, see pull request #4538

Thanks for using up your free tier helping me, hopefully now I can give back in thanks to the community.

4 Likes