2014-02-14 00:42:35 +08:00
|
|
|
#mixin for all guardian methods dealing with post permissions
|
2014-05-12 22:30:10 +08:00
|
|
|
module PostGuardian
|
2015-04-01 00:58:56 +08:00
|
|
|
|
2014-01-10 07:25:14 +08:00
|
|
|
# Can the user act on the post in a particular way.
|
|
|
|
# taken_actions = the list of actions the user has already taken
|
|
|
|
def post_can_act?(post, action_key, opts={})
|
2016-12-21 12:01:26 +08:00
|
|
|
|
|
|
|
return false unless can_see_post?(post)
|
|
|
|
|
|
|
|
# no warnings except for staff
|
|
|
|
return false if (action_key == :notify_user && !is_staff? && opts[:is_warning].present? && opts[:is_warning] == 'true')
|
|
|
|
|
2014-01-10 07:25:14 +08:00
|
|
|
taken = opts[:taken_actions].try(:keys).to_a
|
|
|
|
is_flag = PostActionType.is_flag?(action_key)
|
|
|
|
already_taken_this_action = taken.any? && taken.include?(PostActionType.types[action_key])
|
|
|
|
already_did_flagging = taken.any? && (taken & PostActionType.flag_types.values).any?
|
|
|
|
|
2015-04-08 10:29:43 +08:00
|
|
|
result = if authenticated? && post && !@user.anonymous?
|
2014-12-20 05:47:39 +08:00
|
|
|
|
|
|
|
return false if action_key == :notify_moderators && !SiteSetting.enable_private_messages
|
|
|
|
|
2014-03-10 23:48:27 +08:00
|
|
|
# we allow flagging for trust level 1 and higher
|
2015-01-08 23:06:43 +08:00
|
|
|
# always allowed for private messages
|
|
|
|
(is_flag && not(already_did_flagging) && (@user.has_trust_level?(TrustLevel[1]) || post.topic.private_message?)) ||
|
2014-01-10 07:25:14 +08:00
|
|
|
|
|
|
|
# not a flagging action, and haven't done it already
|
|
|
|
not(is_flag || already_taken_this_action) &&
|
|
|
|
|
2014-08-08 01:12:35 +08:00
|
|
|
# nothing except flagging on archived topics
|
2015-02-04 03:51:29 +08:00
|
|
|
not(post.topic.try(:archived?)) &&
|
2014-01-10 07:25:14 +08:00
|
|
|
|
2014-08-08 01:12:35 +08:00
|
|
|
# nothing except flagging on deleted posts
|
|
|
|
not(post.trashed?) &&
|
|
|
|
|
2014-01-10 07:25:14 +08:00
|
|
|
# don't like your own stuff
|
|
|
|
not(action_key == :like && is_my_own?(post)) &&
|
|
|
|
|
2014-03-10 23:48:27 +08:00
|
|
|
# new users can't notify_user because they are not allowed to send private messages
|
2015-10-12 08:15:38 +08:00
|
|
|
not(action_key == :notify_user && !@user.has_trust_level?(SiteSetting.min_trust_to_send_messages)) &&
|
2014-03-10 23:48:27 +08:00
|
|
|
|
2014-12-20 05:47:39 +08:00
|
|
|
# can't send private messages if they're disabled globally
|
|
|
|
not(action_key == :notify_user && !SiteSetting.enable_private_messages) &&
|
|
|
|
|
2014-01-10 07:25:14 +08:00
|
|
|
# no voting more than once on single vote topics
|
|
|
|
not(action_key == :vote && opts[:voted_in_topic] && post.topic.has_meta_data_boolean?(:single_vote))
|
|
|
|
end
|
2015-04-08 10:29:43 +08:00
|
|
|
|
|
|
|
!!result
|
2014-01-10 07:25:14 +08:00
|
|
|
end
|
|
|
|
|
2014-07-29 01:17:37 +08:00
|
|
|
def can_defer_flags?(post)
|
2016-12-21 12:01:26 +08:00
|
|
|
can_see_post?(post) && is_staff? && post
|
2014-01-10 07:25:14 +08:00
|
|
|
end
|
|
|
|
|
|
|
|
# Can we see who acted on a post in a particular way?
|
|
|
|
def can_see_post_actors?(topic, post_action_type_id)
|
2014-08-08 01:12:35 +08:00
|
|
|
return true if is_admin?
|
2014-01-10 07:25:14 +08:00
|
|
|
return false unless topic
|
|
|
|
|
|
|
|
type_symbol = PostActionType.types[post_action_type_id]
|
|
|
|
return false if type_symbol == :bookmark
|
|
|
|
return can_see_flags?(topic) if PostActionType.is_flag?(type_symbol)
|
|
|
|
|
|
|
|
if type_symbol == :vote
|
|
|
|
# We can see votes if the topic allows for public voting
|
|
|
|
return false if topic.has_meta_data_boolean?(:private_poll)
|
|
|
|
end
|
|
|
|
|
|
|
|
true
|
|
|
|
end
|
|
|
|
|
|
|
|
def can_delete_all_posts?(user)
|
2014-07-29 01:17:37 +08:00
|
|
|
is_staff? &&
|
|
|
|
user &&
|
|
|
|
!user.admin? &&
|
|
|
|
(user.first_post_created_at.nil? || user.first_post_created_at >= SiteSetting.delete_user_max_post_age.days.ago) &&
|
|
|
|
user.post_count <= SiteSetting.delete_all_posts_max.to_i
|
2014-01-10 07:25:14 +08:00
|
|
|
end
|
|
|
|
|
|
|
|
# Creating Method
|
|
|
|
def can_create_post?(parent)
|
2016-01-23 01:54:18 +08:00
|
|
|
(!SpamRule::AutoBlock.block?(@user) || (!!parent.try(:private_message?) && parent.allowed_users.include?(@user))) && (
|
2014-04-19 00:42:31 +08:00
|
|
|
!parent ||
|
|
|
|
!parent.category ||
|
|
|
|
Category.post_create_allowed(self).where(:id => parent.category.id).count == 1
|
2014-01-10 07:25:14 +08:00
|
|
|
)
|
|
|
|
end
|
|
|
|
|
|
|
|
# Editing Method
|
|
|
|
def can_edit_post?(post)
|
2014-07-29 22:40:02 +08:00
|
|
|
if Discourse.static_doc_topic_ids.include?(post.topic_id) && !is_admin?
|
|
|
|
return false
|
|
|
|
end
|
|
|
|
|
2016-04-13 13:59:38 +08:00
|
|
|
return true if is_admin?
|
|
|
|
|
2014-09-05 13:20:39 +08:00
|
|
|
if is_staff? || @user.has_trust_level?(TrustLevel[4])
|
2016-04-13 13:59:38 +08:00
|
|
|
return can_create_post?(post.topic)
|
2014-05-13 20:53:11 +08:00
|
|
|
end
|
|
|
|
|
2016-03-31 02:18:42 +08:00
|
|
|
if post.topic.archived? || post.user_deleted || post.deleted_at
|
2014-05-13 20:53:11 +08:00
|
|
|
return false
|
|
|
|
end
|
|
|
|
|
|
|
|
if post.wiki && (@user.trust_level >= SiteSetting.min_trust_to_edit_wiki_post.to_i)
|
|
|
|
return true
|
|
|
|
end
|
|
|
|
|
2014-06-21 03:38:03 +08:00
|
|
|
if is_my_own?(post)
|
2014-09-16 23:20:31 +08:00
|
|
|
if post.hidden?
|
|
|
|
return false if post.hidden_at.present? &&
|
|
|
|
post.hidden_at >= SiteSetting.cooldown_minutes_after_hiding_posts.minutes.ago
|
|
|
|
|
|
|
|
# If it's your own post and it's hidden, you can still edit it
|
|
|
|
return true
|
|
|
|
end
|
2014-06-21 03:38:03 +08:00
|
|
|
|
|
|
|
return !post.edit_time_limit_expired?
|
2014-05-13 20:53:11 +08:00
|
|
|
end
|
|
|
|
|
|
|
|
false
|
2014-01-10 07:25:14 +08:00
|
|
|
end
|
|
|
|
|
|
|
|
# Deleting Methods
|
|
|
|
def can_delete_post?(post)
|
2016-12-21 12:01:26 +08:00
|
|
|
can_see_post?(post)
|
|
|
|
|
2014-01-10 07:25:14 +08:00
|
|
|
# Can't delete the first post
|
2015-04-24 01:33:29 +08:00
|
|
|
return false if post.is_first_post?
|
2014-01-10 07:25:14 +08:00
|
|
|
|
|
|
|
# Can't delete after post_edit_time_limit minutes have passed
|
|
|
|
return false if !is_staff? && post.edit_time_limit_expired?
|
|
|
|
|
2014-01-18 06:42:12 +08:00
|
|
|
# Can't delete posts in archived topics unless you are staff
|
|
|
|
return false if !is_staff? && post.topic.archived?
|
|
|
|
|
2014-01-10 07:25:14 +08:00
|
|
|
# You can delete your own posts
|
|
|
|
return !post.user_deleted? if is_my_own?(post)
|
|
|
|
|
|
|
|
is_staff?
|
|
|
|
end
|
|
|
|
|
|
|
|
# Recovery Method
|
|
|
|
def can_recover_post?(post)
|
|
|
|
is_staff? || (is_my_own?(post) && post.user_deleted && !post.deleted_at)
|
|
|
|
end
|
|
|
|
|
|
|
|
def can_delete_post_action?(post_action)
|
|
|
|
# You can only undo your own actions
|
|
|
|
is_my_own?(post_action) && not(post_action.is_private_message?) &&
|
|
|
|
|
|
|
|
# Make sure they want to delete it within the window
|
|
|
|
post_action.created_at > SiteSetting.post_undo_action_window_mins.minutes.ago
|
|
|
|
end
|
|
|
|
|
|
|
|
def can_see_post?(post)
|
2015-09-11 04:01:23 +08:00
|
|
|
return false if post.blank?
|
|
|
|
return true if is_admin?
|
|
|
|
return false unless can_see_topic?(post.topic)
|
2015-09-22 06:50:52 +08:00
|
|
|
return false unless post.user == @user || Topic.visible_post_types(@user).include?(post.post_type)
|
2015-09-11 04:01:23 +08:00
|
|
|
return false if !is_moderator? && post.deleted_at.present?
|
|
|
|
|
|
|
|
true
|
2014-01-10 07:25:14 +08:00
|
|
|
end
|
|
|
|
|
2014-10-28 05:06:43 +08:00
|
|
|
def can_view_edit_history?(post)
|
2014-05-12 22:30:10 +08:00
|
|
|
return false unless post
|
2014-06-27 01:19:35 +08:00
|
|
|
|
|
|
|
if !post.hidden
|
2016-07-16 19:30:00 +08:00
|
|
|
return true if post.wiki || SiteSetting.edit_history_visible_to_public
|
2014-06-27 01:19:35 +08:00
|
|
|
end
|
2014-05-12 22:30:10 +08:00
|
|
|
|
2014-03-13 22:47:37 +08:00
|
|
|
authenticated? &&
|
2014-09-05 13:20:39 +08:00
|
|
|
(is_staff? || @user.has_trust_level?(TrustLevel[4]) || @user.id == post.user_id) &&
|
2014-05-12 22:30:10 +08:00
|
|
|
can_see_post?(post)
|
2014-01-10 07:25:14 +08:00
|
|
|
end
|
|
|
|
|
|
|
|
def can_vote?(post, opts={})
|
|
|
|
post_can_act?(post,:vote, opts)
|
|
|
|
end
|
2014-03-28 09:28:14 +08:00
|
|
|
|
|
|
|
def can_change_post_owner?
|
|
|
|
is_admin?
|
|
|
|
end
|
2014-05-13 20:53:11 +08:00
|
|
|
|
2016-01-11 23:26:00 +08:00
|
|
|
def can_wiki?(post)
|
|
|
|
return false unless authenticated?
|
2016-03-15 17:13:52 +08:00
|
|
|
return true if is_staff? || @user.has_trust_level?(TrustLevel[4])
|
|
|
|
|
|
|
|
if @user.has_trust_level?(SiteSetting.min_trust_to_allow_self_wiki) && is_my_own?(post)
|
|
|
|
return false if post.hidden?
|
|
|
|
return !post.edit_time_limit_expired?
|
|
|
|
end
|
|
|
|
|
|
|
|
false
|
2014-05-13 20:53:11 +08:00
|
|
|
end
|
2014-07-17 03:04:55 +08:00
|
|
|
|
2014-09-11 05:08:33 +08:00
|
|
|
def can_change_post_type?
|
|
|
|
is_staff?
|
|
|
|
end
|
|
|
|
|
2014-09-11 22:04:40 +08:00
|
|
|
def can_rebake?
|
2015-02-04 01:19:01 +08:00
|
|
|
is_staff? || @user.has_trust_level?(TrustLevel[4])
|
2014-09-11 22:04:40 +08:00
|
|
|
end
|
|
|
|
|
2014-07-17 03:04:55 +08:00
|
|
|
def can_see_flagged_posts?
|
|
|
|
is_staff?
|
|
|
|
end
|
|
|
|
|
|
|
|
def can_see_deleted_posts?
|
|
|
|
is_staff?
|
|
|
|
end
|
2014-09-23 00:55:13 +08:00
|
|
|
|
2014-11-12 21:49:42 +08:00
|
|
|
def can_view_raw_email?(post)
|
|
|
|
post && (is_staff? || post.user_id == @user.id)
|
2014-10-18 03:18:29 +08:00
|
|
|
end
|
|
|
|
|
2014-09-23 00:55:13 +08:00
|
|
|
def can_unhide?(post)
|
|
|
|
post.try(:hidden) && is_staff?
|
|
|
|
end
|
2014-01-18 06:42:12 +08:00
|
|
|
end
|