Nil dereference in PostGuardian can_delete_post

bug
1

PostGuardian.can_delete_post contains a user dereference which crashes when called when there is no user logged in. Calling it from a plugin so maybe this doesn’t happen in core at the moment.

It’s happening here:

return true if user.in_any_groups?(SiteSetting.delete_all_posts_and_topics_allowed_groups_map)

Suggestion is to either use the save navigation operator &. or change it to return true if user && user.in_any_groups? ...

3 Likes
3

Could you perhaps use @system as a user for this, since it should always have perms? (Also, doesn’t core do that too?)

4

I’m not sure you understand.

It’s not a problem that there is no user (and “no user” should equal “no permissions”). The problem is that the code assumes there is a user without checking, so it tries to see if “nothing” is in any groups.

1 Like