# Guardian bypassed through :skip\_validations in TopicCreator but not in PostCreator

**URL:** https://meta.discourse.org/t/guardian-bypassed-through-skip-validations-in-topiccreator-but-not-in-postcreator/55341
**Category:** Development
**Created:** [1월 7, 2017, 9:26오후 UTC](https://meta.discourse.org/t/guardian-bypassed-through-skip-validations-in-topiccreator-but-not-in-postcreator/55341 "2017-01-07T21:26:40Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![meriksson](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/meriksson/32/66712_2.png) [@meriksson](https://meta.discourse.org/u/meriksson)
#### Post date: [1월 7, 2017, 9:26오후 UTC](https://meta.discourse.org/t/guardian-bypassed-through-skip-validations-in-topiccreator-but-not-in-postcreator/55341/1 "2017-01-07T21:26:40Z")

</div>

When creating a topic, the guardian check for permission to create is bypassed if `skip_validations` is set to true:

> <https://github.com/discourse/discourse/blob/56ee4ffadc3e686718d25f46be8c08d9289ef396/lib/topic_creator.rb#L118>

However, when creating a reply the equivalent check is not bypassed:

> <https://github.com/discourse/discourse/blob/cf7774bdd9cb5e3337fbcdebc285175d1240aa35/lib/post_creator.rb#L111>

Perhaps I am missing something but this looks inconsistent to me, i.e. `skip_validations` should bypass the guardian check either in both cases or in none of them.

In any case, I fixed this because I needed it myself (to have an importer create posts in private categories). Here is what I did:

[https://github.com/discourse/discourse/pull/4641](https://github.com/discourse/discourse/pull/4641)

---

<div class="post-metadata">

### Author: ![Isambard](https://avatars.discourse-cdn.com/v4/letter/i/858c86/32.png) [@Isambard](https://meta.discourse.org/u/Isambard)
#### Post date: [3월 20, 2024, 8:35오후 UTC](https://meta.discourse.org/t/guardian-bypassed-through-skip-validations-in-topiccreator-but-not-in-postcreator/55341/2 "2024-03-20T20:35:06Z")

</div>

> [@API를 통해 주제/게시물을 생성할 때 어떤 검증을 우회할 수 있으며, 어떻게 우회할 수 있나요?](https://meta.discourse.org/t/which-validations-can-be-bypassed-and-how-when-using-the-api-to-create-topics-posts/299282/4?u=isambard):
>
> I think there is a bug in the skip validations. When I use skip validations to create a Topic, this works and it is possible for user to create a topic in a category even if normally he would have no rights to do so. However, when trying to reply to that same topic, the validation check is not skipped and this post create fails.

저도 방금 이 버그를 겪었습니다. 6년 전에 수정해서 풀 리퀘스트를 제출했는데 결국 받아들여지지 않았다는 점이 정말 답답합니다. ☹