This is reproducible anywhere with Discourse assign, including here. Just enter ga when not in a text box and the bind triggers, regardless if you’re allowed to do so or not.
3 إعجابات
Good catch 
That line might need to be moved inside a api.getCurrentUser()?.can_assign condition.
4 إعجابات