Tags-Seite zeigt Tags ohne sichtbare Themen an

Canapin · 10. Dezember 2022 um 12:31

Hallo!

Auf https://meta.discourse.org/tags gibt es einige Tags, die anscheinend verwendet werden, zum Beispiel:

swag x 2
oder
csreachout x 1

die zu leeren Themenlisten führen:

Ist das ein Fehler oder werden einige Tag-Statistiken noch nicht aktualisiert (warten auf einen Sidekiq-Job oder so)?

Stephen · 10. Dezember 2022 um 12:37

Ich glaube, Tags lassen die Existenz von Themen aus privaten Kategorien durchsickern.

JammyDodger · 10. Dezember 2022 um 12:42

Guter Fang @Canapin

Ja, es sieht so aus, als ob die Tag-Themenanzahl sichtbar ist, obwohl sie es nicht sein sollte. Verschieben wir das zu Bug

JammyDodger · 2. Februar 2023 um 05:55

Ich glaube, das wurde behoben in:

github.com/discourse/discourse

SECURITY: Default tags to show count of topics in unrestricted categories

main ← tgxworld:security_hide_secured_topic_count

opened 02:55AM - 19 Jan 23 UTC

tgxworld

+603 -128

## What is the problem here? Currently, `Tag#topic_count` is a count of all …regular topics regardless of whether the topic is in a read restricted category or not. As a result, any users can technically poll a sensitive tag to determine if a new topic is created in a category which the user has not excess to. We classify this as a minor leak in sensitive information. ## What does this PR change? 1. Introduce `Tag#public_topic_count` which only count topics which have been tagged with a given tag in public categories. 2. Rename `Tag#topic_count` to `Tag#staff_topic_count` which counts the same way as `Tag#topic_count`. In other words, it counts all topics tagged with a given tag regardless of the category the topic is in. The rename is also done so that we indicate that this column contains sensitive information. 3. Change all previous spots which relied on `Topic#topic_count` to rely on `Tag.topic_column_count(guardian)` which will return the right "topic count" column to use based on the current scope. 4. Introduce `SiteSetting.include_secure_categories_in_tag_counts` site setting to allow site administrators to always display the tag topics count using `Tag#staff_topic_count` instead. ## Notes for reviewer 1. It is easier to follow this PR if you follow the commits in the order they were made. 1. This was discussed internally and our objective here is not to display the count as accurately as possible. Making the count accurate for all users is complicated to do and we're not ready to make that investment at this point in time.

JammyDodger · 6. Februar 2023 um 08:00

Dieses Thema wurde nach 4 Tagen automatisch geschlossen. Neue Antworten sind nicht mehr möglich.

Thema		Antworten	Aufrufe
Accurate topic count in tag list Feature	11	1160	26. August 2020
Incorrect Count on /tags page (included deleted topics - now fixed) Bug	13	2507	28. August 2017
Tag pages show only 10 entries Support	10	1328	9. Mai 2019
Unlisted topics are included in the Tag (topic) count for normal users who don't actually see those topics Feature unlisting	5	1248	20. Februar 2016
Plugin - Get unseen topic count per tag Dev	4	849	29. September 2017

Tags-Seite zeigt Tags ohne sichtbare Themen an

Verwandte Themen