discourse/app
Isaac Janzen 366ff0e76b
FIX: Don't display destroy reviewable button on client (#21226)
# Context

https://meta.discourse.org/t/missing-translate-in-review-page/262604

![image](https://user-images.githubusercontent.com/50783505/234089049-72332040-e7d5-4081-824a-b0b36e37187a.png)

An additional button was added as a result of dd495a0e19 which was intended to grant access to deleting reviewable from the API. 

We were being too flexible by only checking if the user was an admin

012aaf0ba3/lib/guardian.rb (L237)

where it should instead by scoped to check if the request was an API call.

# Fix

https://github.com/discourse/discourse/pull/21226/files#diff-0a2548be4b18bd4ef2dffb3ef8e44984d2fef7f037b53e98f67abea52ef75aa2R237

# Additions

Added a new guard of `is_api?`

https://github.com/discourse/discourse/pull/21226/files#diff-0a2548be4b18bd4ef2dffb3ef8e44984d2fef7f037b53e98f67abea52ef75aa2R657-R660

In `app/models/reviewable.rb` we check if the user has the permissions to the destroy action via the `Guardian`. To do this we were instantiating a new `Guardian` class which then caused us to lose the context of the request. The request is a necessary component in the guard of `is_api?` so we needed to pass the already defined Guardian from the `app/controllers/reviewables_controller.rb` to the `#perform` method to ensure the request is present.
2023-04-24 20:22:37 -05:00
..
assets FIX: Show auto-group flair according to user preferences (#21221) 2023-04-24 16:04:26 -03:00
controllers FIX: Don't display destroy reviewable button on client (#21226) 2023-04-24 20:22:37 -05:00
helpers UX: Improve login required page (#20847) 2023-03-28 07:09:44 -05:00
jobs FIX: Ensure reviewable counts are updated correctly for new user menu (#21222) 2023-04-24 16:59:32 +01:00
mailers DEV: Replace #pluck_first freedom patch with AR #pick in core (#19893) 2023-02-13 12:39:45 +08:00
models FIX: Don't display destroy reviewable button on client (#21226) 2023-04-24 20:22:37 -05:00
serializers FIX: Show auto-group flair according to user preferences (#21221) 2023-04-24 16:04:26 -03:00
services PERF: Don't serialize value for theme_fields unnecessarily (#21201) 2023-04-24 09:30:51 -05:00
views UX: better digest centering in event of truncation (#21176) 2023-04-20 09:33:50 -04:00