diff --git a/lib/guardian/group_guardian.rb b/lib/guardian/group_guardian.rb index 7246f6c5e17..7aa0f9ebfcc 100644 --- a/lib/guardian/group_guardian.rb +++ b/lib/guardian/group_guardian.rb @@ -35,6 +35,7 @@ module GroupGuardian def can_see_group_messages?(group) return true if is_admin? + return true if is_moderator? && group.id == Group::AUTO_GROUPS[:moderators] SiteSetting.enable_personal_messages? && group.users.include?(user) end diff --git a/spec/requests/list_controller_spec.rb b/spec/requests/list_controller_spec.rb index 1bcab4542d7..954765e46fc 100644 --- a/spec/requests/list_controller_spec.rb +++ b/spec/requests/list_controller_spec.rb @@ -197,6 +197,17 @@ RSpec.describe ListController do .to eq(topic.id) end + it 'should display moderator group private messages for a moderator' do + moderator = Fabricate(:moderator) + group = Group.find(Group::AUTO_GROUPS[:moderators]) + topic = Fabricate(:private_message_topic, allowed_groups: [group]) + + sign_in(moderator) + + get "/topics/private-messages-group/#{moderator.username}/#{group.name}.json" + expect(response.status).to eq(200) + end + it "should not display group private messages for a moderator's group" do moderator = Fabricate(:moderator) sign_in(moderator)