# Change topic timestamp results in 403 (Forbidden)

**URL:** <https://meta.discourse.org/t/change-topic-timestamp-results-in-403-forbidden/52312>\
**Category:** Development\
**Created:** [2016年十一月1日 17:00 UTC](https://meta.discourse.org/t/change-topic-timestamp-results-in-403-forbidden/52312 "2016-11-01T17:00:17Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![kgish](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/kgish/32/121131_2.png) [@kgish](https://meta.discourse.org/u/kgish)\
**Post date:** [2016年十一月1日 17:00 UTC](https://meta.discourse.org/t/change-topic-timestamp-results-in-403-forbidden/52312/1 "2016-11-01T17:00:18Z")

</div>

I would like to allow regular users to trigger certain events (create annotation, likes, votes) on a given topic whereby the topic timestamp is updated.

I noticed that the `POST /t/:topic_id/change-timestamp` request returns a `403 (Forbidden)` whereas if I am logged in as admin it works just fine.

What should I do in order to allow the timestamp of a topic to be updated by non-admin folks?

---

<div class="post-metadata">

**Author:** ![sam](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sam/32/102149_2.png) [@sam](https://meta.discourse.org/u/sam)\
**Post date:** [2016年十一月2日 03:37 UTC](https://meta.discourse.org/t/change-topic-timestamp-results-in-403-forbidden/52312/2 "2016-11-02T03:37:56Z")

</div>

That is ultra admin functionality. I am not sure I even want a site setting for “min trust level to muck with timestamps”

I guess best I can thing of is to make sure that there is a discrete function in guardian and monkey patch that in a plugin. Then add tests to your plugin to ensure nothing regresses long term.

---

<div class="post-metadata">

**Author:** ![kgish](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/kgish/32/121131_2.png) [@kgish](https://meta.discourse.org/u/kgish)\
**Post date:** [2016年十一月2日 15:20 UTC](https://meta.discourse.org/t/change-topic-timestamp-results-in-403-forbidden/52312/3 "2016-11-02T15:20:15Z")

</div>

Please explain in more detail how to monkey patch the guardian functionality.

---

<div class="post-metadata">

**Author:** ![sam](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sam/32/102149_2.png) [@sam](https://meta.discourse.org/u/sam)\
**Post date:** [2016年十一月3日 11:40 UTC](https://meta.discourse.org/t/change-topic-timestamp-results-in-403-forbidden/52312/4 "2016-11-03T11:40:28Z")

</div>

Not sure where to start, are you a developer? How is your Ruby? Can you write Discourse plugins?

---

<div class="post-metadata">

**Author:** ![kgish](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/kgish/32/121131_2.png) [@kgish](https://meta.discourse.org/u/kgish)\
**Post date:** [2016年十一月3日 23:29 UTC](https://meta.discourse.org/t/change-topic-timestamp-results-in-403-forbidden/52312/5 "2016-11-03T23:29:09Z")

</div>

I’m a hardcore developer making my own plugin using ruby, javascript and ember. So feel free to hit me as hard as you want with low-level details, I can handle it.

---

<div class="post-metadata">

**Author:** ![gdpelican](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/gdpelican/32/81308_2.png) [@gdpelican](https://meta.discourse.org/u/gdpelican)\
**Post date:** [2016年十一月4日 00:39 UTC](https://meta.discourse.org/t/change-topic-timestamp-results-in-403-forbidden/52312/6 "2016-11-04T00:39:24Z")

</div>

I’m monkey patching the Guardian class in Babble [here](https://github.com/gdpelican/babble/blob/beta/plugin.rb#L511):

```plaintext
class ::Guardian
  module CanSeeTopic
    def can_see_topic?(topic)
      super || some_other_condition
    end
  end
  prepend CanSeeTopic
end

```

[Module#prepend](http://dev.af83.com/2012/10/19/ruby-2-0-module-prepend.html) is a little opaque, but in short it allows you to invoke the ‘original’ function of the class with `super`. Then you can add additional checks to the function to suit your needs.

If you don’t care about what the original functionality is, you can also simply wipe the original implementation like so:

```plaintext
class ::Guardian
  def can_see_topic?(topic)
    false # no topics for anyone! 😈 
  end
end

```

Note that this is a little bit riskier because the original implementation may change without you knowing it.

---

<div class="post-metadata">

**Author:** ![kgish](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/kgish/32/121131_2.png) [@kgish](https://meta.discourse.org/u/kgish)\
**Post date:** [2016年十一月6日 14:25 UTC](https://meta.discourse.org/t/change-topic-timestamp-results-in-403-forbidden/52312/7 "2016-11-06T14:25:10Z")

</div>

Okay thanks, this is more clear now. However, I cannot find a comparable guardian method for `can_change_timestamp` so how do I implement that?

---

<div class="post-metadata">

**Author:** ![gdpelican](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/gdpelican/32/81308_2.png) [@gdpelican](https://meta.discourse.org/u/gdpelican)\
**Post date:** [2016年十一月6日 15:06 UTC](https://meta.discourse.org/t/change-topic-timestamp-results-in-403-forbidden/52312/8 "2016-11-06T15:06:38Z")

</div>

Looks like it uses the `can_change_post_owner?` permission.

---

<div class="post-metadata">

**Author:** ![kgish](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/kgish/32/121131_2.png) [@kgish](https://meta.discourse.org/u/kgish)\
**Post date:** [2016年十一月6日 18:14 UTC](https://meta.discourse.org/t/change-topic-timestamp-results-in-403-forbidden/52312/9 "2016-11-06T18:14:12Z")

</div>

So how then would I implement this ONLY when changing the timestamp and NOT otherwise?

---

<div class="post-metadata">

**Author:** ![gdpelican](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/gdpelican/32/81308_2.png) [@gdpelican](https://meta.discourse.org/u/gdpelican)\
**Post date:** [2016年十一月6日 18:19 UTC](https://meta.discourse.org/t/change-topic-timestamp-results-in-403-forbidden/52312/10 "2016-11-06T18:19:39Z")

</div>

Sorry, I’ve hit the limit of my free tier ¯\_(ツ)_/¯

You’ll have to patch together the existing methods somehow so it either uses another permission that you define, or that the existing permission is smart enough to know when it’s changing a timestamp and when it’s doing other stuff.

---

<div class="post-metadata">

**Author:** ![kgish](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/kgish/32/121131_2.png) [@kgish](https://meta.discourse.org/u/kgish)\
**Post date:** [2016年十一月6日 20:24 UTC](https://meta.discourse.org/t/change-topic-timestamp-results-in-403-forbidden/52312/11 "2016-11-06T20:24:10Z")

</div>

No problem, see pull request [#4538](https://github.com/discourse/discourse/pull/4538)

Thanks for using up your free tier helping me, hopefully now I can give back in thanks to the community.