Grace period edits bypass `skip_review_media_groups` media review

Contribute Fout
, , ,
1

Summary

The “review media” check (skip_review_media_groups site setting) is only enforced
at post creation time, in NewPostManager. Edits go through PostRevisor,
which never runs the media check. A user can therefore post plain text first
(passing review), then add images via an edit — and the post never enters the
review queue.

Worse, if the edit happens within editing_grace_period (default 5 minutes) and
the diff is smaller than editing_grace_period_max_diff (default 100 chars —
a single uploaded-image markdown line is ~40–60 chars), the edit creates no
revision and no pencil icon, so the bypass is completely invisible in the UI.

Steps to reproduce

  1. Configure skip_review_media_groups so that regular users (e.g. TL0/TL1) are
    not exempt — posts with media should require approval.
  2. As a regular user, create a post containing only text. It is approved/posted
    normally (no media → no review).
  3. Within the grace period, edit the post and insert an uploaded image.

Expected

The post (now containing media) should be sent to the review queue, or at least
the edit should be subject to the same media check as post creation.

Actual

  • The post is published with the image and never enters the review queue.
  • No revision record is created, no edit indicator is shown.

Evidence (production instance)

p.version                                   # => 1
PostRevision.where(post_id: p.id).count     # => 0
p.created_at                                # => 2026-07-30 07:33:28 UTC
p.updated_at                                # => 2026-07-30 07:34:00 UTC
UploadReference.where(target: p).pluck(:created_at)
                                            # => [2026-07-30 07:34:01 UTC]

Text-only post created at 07:33:28, image added by an edit ~32 seconds later —
no visible edit history, no review.

Relevant code

  • lib/new_post_manager.rb — post_needs_approval? returns :contains_media
    via contains_embedded_media?, but this only runs for new posts.
  • app/models/post_analyzer.rb#embedded_media_count — the media counting logic.
  • PostRevisor — no equivalent media check on edit.

Suggested fix

Run the contains_media check in PostRevisor as well (when the edit
introduces media and the editor is not in skip_review_media_groups / not
staff), enqueueing a ReviewablePost for the edited post.

1 like