Users can create posts from staff-only tag pages (/tags/staff-only-tag). These go straight to moderation, but it seems it would be better to disable the new topic button on these pages.
Hmm that does feel like a bug. @nbianca could you have a look next week?
Wouldn’t it be a better idea to just display a 404 if the user isn’t supposed to see the tag because its part of a “Staff Only” group?
# app/controllers/tags_controller.rb def show unless TagGroup.visible(guardian).pluck(:id)&.include? Tag.find_by_name(params[:tag_id]).tag_groups.pluck(:id) raise Discourse::NotFound end show_latest end
Any opinion on this? I would create a PR and also write some tests
I have fixed both of the issues in this PR: