Guardian bypassed through :skip_validations in TopicCreator but not in PostCreator

meriksson · 7. Januar 2017 um 21:26

When creating a topic, the guardian check for permission to create is bypassed if skip_validations is set to true:

lib/topic_creator.rb

56ee4ffad


      
          
          if topic_params[:import_mode] && @opts[:views].to_i > 0
            topic_params[:views] = @opts[:views].to_i
          end
          
          # Automatically give it a moderator warning subtype if specified
          topic_params[:subtype] = TopicSubtype.moderator_warning if @opts[:is_warning]
          
          category = find_category
          
          @guardian.ensure_can_create!(Topic, category) unless (@opts[:skip_validations] || @opts[:archetype] == Archetype.private_message)
          
          topic_params[:category_id] = category.id if category.present?
          
          topic_params[:created_at] = Time.zone.parse(@opts[:created_at].to_s) if @opts[:created_at].present?
          
          topic_params[:pinned_at] = Time.zone.parse(@opts[:pinned_at].to_s) if @opts[:pinned_at].present?
          topic_params[:pinned_globally] = @opts[:pinned_globally] if @opts[:pinned_globally].present?
          
          if SiteSetting.topic_featured_link_enabled && @opts[:featured_link].present? && @guardian.can_edit_featured_link?(topic_params[:category_id])
            topic_params[:featured_link] = @opts[:featured_link]

However, when creating a reply the equivalent check is not bypassed:

github.com/discourse/discourse

lib/post_creator.rb

cf7774bdd


      
              errors[:base] << I18n.t(:not_accepting_pms, username: users[m])
            end
            return false if errors[:base].present?
          end
          
          if new_topic?
            topic_creator = TopicCreator.new(@user, guardian, @opts)
            return false unless skip_validations? || validate_child(topic_creator)
          else
            @topic = Topic.find_by(id: @opts[:topic_id])
            if (@topic.blank? || !guardian.can_create?(Post, @topic))
              errors[:base] << I18n.t(:topic_not_found)
              return false
            end
          end
          
          setup_post
          
          return true if skip_validations?
          
          if @post.has_host_spam?

Perhaps I am missing something but this looks inconsistent to me, i.e. skip_validations should bypass the guardian check either in both cases or in none of them.

In any case, I fixed this because I needed it myself (to have an importer create posts in private categories). Here is what I did:

https://github.com/discourse/discourse/pull/4641

Isambard · 20. März 2024 um 20:35

Ich bin gerade auch auf diesen Fehler gestoßen. Sehr frustrierend, dass Sie ihn vor 6 Jahren behoben und einen Pull Request herausgegeben haben, der am Ende nicht akzeptiert wurde.

Thema		Antworten	Aufrufe
Which validations can be bypassed and how when using the API to create topics/posts Development rest-api	5	441	20. März 2024
Cannot Create New Topics Support	7	760	2. Oktober 2023
Cannot create topic via API when category is “see & reply only” Support rest-api	1	83	15. Juli 2025
Urgent, can't create new Topics Bug	7	1152	3. April 2017
"Why Not Create a topic?" in category without topic creating permissions Bug	3	1217	10. Januar 2020

Guardian bypassed through :skip_validations in TopicCreator but not in PostCreator

Verwandte Themen