Entering "ga" always opens a user's assignments, even when they can't access them

Firepup650 · May 10, 2024, 10:53pm

This is reproducible anywhere with Discourse assign, including here. Just enter ga when not in a text box and the bind triggers, regardless if you’re allowed to do so or not.

Arkshine · May 11, 2024, 12:02am

Good catch

github.com

discourse/discourse-assign/blob/main/assets/javascripts/discourse/initializers/extend-for-assigns.js#L758


      
              pluginId: PLUGIN_ID,
          
              actions: {
                save() {
                  this.saveAttrNames.push("custom_fields");
                  this._super(...arguments);
                },
              },
            });
          
            api.addKeyboardShortcut("g a", "", { path: "/my/activity/assigned" });
          }
          
          const REGEXP_USERNAME_PREFIX = /^(assigned:)/gi;
          
          export default {
            name: "extend-for-assign",
          
            initialize(container) {
              const siteSettings = container.lookup("service:site-settings");
              if (!siteSettings.assign_enabled) {

That line might need to be moved inside a api.getCurrentUser()?.can_assign condition.

Topic		Replies	Views
Editting an assigned post re-sends the assigned mail Bug	7	679	January 10, 2019
Bug - increasing "max assigned topics" doesn't help Bug assign	8	1276	October 21, 2022
Assigning a due date? Feature assign	5	1811	March 22, 2021
Incoming mail is rejected if in-reply-to a post in a non-accessible topic even if sent to a group inbox Bug	10	1850	June 4, 2019
"Public assigns" shows reassign button? Bug assign	2	450	April 28, 2022

Entering "ga" always opens a user's assignments, even when they can't access them

Related Topics