'New Topic' is active on staff-only tag pages

Bug
1

Users can create posts from staff-only tag pages (/tags/staff-only-tag). These go straight to moderation, but it seems it would be better to disable the new topic button on these pages.

4 Likes
2

Hmm that does feel like a bug. @nbianca could you have a look next week?

4 Likes
4

Wouldn’t it be a better idea to just display a 404 if the user isn’t supposed to see the tag because its part of a “Staff Only” group?

Suggested change:

# app/controllers/tags_controller.rb

def show
  unless TagGroup.visible(guardian).pluck(:id)&.include? Tag.find_by_name(params[:tag_id]).tag_groups.pluck(:id)
    raise Discourse::NotFound
  end

  show_latest
end

Any opinion on this? I would create a PR and also write some tests :slight_smile:

5

Thanks for the help @venarius but @nbianca is already working on a fix.

2 Likes
6

I have fixed both of the issues in this PR:

https://github.com/discourse/discourse/pull/6984

8 Likes