Top Links in Private Categories expose Private Topic Titles to Everyone

[cpradio]

Repo Steps:

1. Create a topic with a link in a Private Category
2. Have several accounts with access click the link (so it increases the chances of it appearing on the Top Links)
3. Logout and visit your profile, the Private Category Topic Title is exposed since the link is in a Private Category
4. Clicking the Private Topic Title gets you the “You need to log in to see that topic” message

Expected:

1. Private Category Links shouldn’t be exposed via Top Links

Example at

cpradio

Note: It appears 4 times because I wrote 4 posts in the private topic with the same links, so they link to 4 separate posts

[zogstrip (Régis Hanol)]

Thanks for the detailed report

Here’s the fix

https://github.com/discourse/discourse/commit/e2928f78d21c26e7e8337664cf6f4c8e80dbc437