Canapin
Décembre 10, 2022, 12:31
1
Salut !
Sur https://meta.discourse.org/tags , il y a des tags qui semblent utilisés, par exemple :
swag x 2csreachout x 1
qui mènent à des listes de sujets vides :
Est-ce un bug ou certaines statistiques de tags ne sont pas encore mises à jour (en attente d’un job Sidekiq ou autre) ?
1 « J'aime »
Stephen
Décembre 10, 2022, 12:37
2
Je pense que les tags divulguent l’existence de sujets de catégories privées.
2 « J'aime »
Bonne pioche @Canapin
Oui, il semble que les comptes de sujets de balises soient effectivement visibles alors qu’ils ne devraient pas l’être. Déplaçons cela vers Contribute > Bug
3 « J'aime »
Je pense que cela a été corrigé dans :
main ← tgxworld:security_hide_secured_topic_count
opened 02:55AM - 19 Jan 23 UTC
## What is the problem here?
Currently, `Tag#topic_count` is a count of all … regular topics regardless of whether the topic is in a read restricted category or not. As a result, any users can technically poll a sensitive tag to determine if a new topic is created in a category which the user has not excess to. We classify this as a minor leak in sensitive information.
## What does this PR change?
1. Introduce `Tag#public_topic_count` which only count topics which have been tagged with a given tag in public categories.
2. Rename `Tag#topic_count` to `Tag#staff_topic_count` which counts the same way as `Tag#topic_count`. In other words, it counts all topics tagged with a given tag regardless of the category the topic is in. The rename is also done so that we indicate that this column contains sensitive information.
3. Change all previous spots which relied on `Topic#topic_count` to rely on `Tag.topic_column_count(guardian)` which will return the right "topic count" column to use based on the current scope.
4. Introduce `SiteSetting.include_secure_categories_in_tag_counts` site setting to allow site administrators to always display the tag topics count using `Tag#staff_topic_count` instead.
## Notes for reviewer
1. It is easier to follow this PR if you follow the commits in the order they were made.
1. This was discussed internally and our objective here is not to display the count as accurately as possible. Making the count accurate for all users is complicated to do and we're not ready to make that investment at this point in time.
1 « J'aime »
JammyDodger
Février 6, 2023, 8:00
10
Ce sujet a été automatiquement fermé après 4 jours. Les nouvelles réponses ne sont plus autorisées.
