‘ga’를 입력하면 접근 권한이 없어도 항상 사용자의 할당 목록이 열립니다

Firepup650 · 5월 10, 2024, 10:53오후

This is reproducible anywhere with Discourse assign, including here. Just enter ga when not in a text box and the bind triggers, regardless if you’re allowed to do so or not.

Arkshine · 5월 11, 2024, 12:02오전

Good catch

github.com/discourse/discourse-assign

assets/javascripts/discourse/initializers/extend-for-assigns.js

main


      
          displayedName =
            !this.siteSettings.prioritize_username_in_ux || !assignee.username
              ? assignee.name || assignee.username
              : assignee.username;
          
          assigneeElements.push(
            h("span.assignee", [
              h(
                "a",
                {
                  attributes: {
                    class: "assigned-indirectly",
                    href: `${topic.url}/${postNumber}`,
                  },
                },
                i18n("discourse_assign.assign_post_to_multiple", {
                  post_number: postNumber,
                  username: displayedName,
                })
              ),
            ])

That line might need to be moved inside a api.getCurrentUser()?.can_assign condition.

글		댓글	조회수
`assigns public` displays inaccessible link to non-staff users Bug assign	1	423	3월 16, 2023
Assign not respecting being disabled Bug assign	2	2495	11월 28, 2018
Discourse Assign Plugin official , assign , included-in-core	34	41211	8월 23, 2026
"Public assigns" shows reassign button? Bug assign	1	478	4월 26, 2022
Assign topics to non-staff users Feature assign	26	5025	7월 7, 2021

‘ga’를 입력하면 접근 권한이 없어도 항상 사용자의 할당 목록이 열립니다

Related topics