Canapin
10. Dezember 2022 um 12:31
1
Hallo!
Auf https://meta.discourse.org/tags gibt es einige Tags, die anscheinend verwendet werden, zum Beispiel:
swag x 2csreachout x 1
die zu leeren Themenlisten führen:
Ist das ein Fehler oder werden einige Tag-Statistiken noch nicht aktualisiert (warten auf einen Sidekiq-Job oder so)?
1 „Gefällt mir“
Stephen
10. Dezember 2022 um 12:37
2
Ich glaube, Tags lassen die Existenz von Themen aus privaten Kategorien durchsickern.
2 „Gefällt mir“
Toller Fund, @Canapin
Ja, es sieht so aus, als wären die Topic-Zählungen von Tags tatsächlich sichtbar, obwohl sie es nicht sein sollten. Lass uns das ins Contribute > Bug
3 „Gefällt mir“
Ich glaube, das wurde behoben in:
main ← tgxworld:security_hide_secured_topic_count
opened 02:55AM - 19 Jan 23 UTC
## What is the problem here?
Currently, `Tag#topic_count` is a count of all … regular topics regardless of whether the topic is in a read restricted category or not. As a result, any users can technically poll a sensitive tag to determine if a new topic is created in a category which the user has not excess to. We classify this as a minor leak in sensitive information.
## What does this PR change?
1. Introduce `Tag#public_topic_count` which only count topics which have been tagged with a given tag in public categories.
2. Rename `Tag#topic_count` to `Tag#staff_topic_count` which counts the same way as `Tag#topic_count`. In other words, it counts all topics tagged with a given tag regardless of the category the topic is in. The rename is also done so that we indicate that this column contains sensitive information.
3. Change all previous spots which relied on `Topic#topic_count` to rely on `Tag.topic_column_count(guardian)` which will return the right "topic count" column to use based on the current scope.
4. Introduce `SiteSetting.include_secure_categories_in_tag_counts` site setting to allow site administrators to always display the tag topics count using `Tag#staff_topic_count` instead.
## Notes for reviewer
1. It is easier to follow this PR if you follow the commits in the order they were made.
1. This was discussed internally and our objective here is not to display the count as accurately as possible. Making the count accurate for all users is complicated to do and we're not ready to make that investment at this point in time.
1 „Gefällt mir“
Dieses Thema wurde nach 4 Tagen automatisch geschlossen. Neue Antworten sind nicht mehr möglich.
