From 846597f5634df08a87898fefecf6853df8b830db Mon Sep 17 00:00:00 2001
From: Sam <sam.saffron@gmail.com>
Date: Fri, 9 Dec 2016 17:24:12 +1100
Subject: [PATCH] FIX: staff tags are stripped by non-staff

---
 lib/discourse_tagging.rb     |  9 ++++++++-
 spec/models/tag_user_spec.rb | 30 ++++++++++++++++++++++++++++++
 2 files changed, 38 insertions(+), 1 deletion(-)

diff --git a/lib/discourse_tagging.rb b/lib/discourse_tagging.rb
index d3e651eb83b..4b7245a17db 100644
--- a/lib/discourse_tagging.rb
+++ b/lib/discourse_tagging.rb
@@ -29,7 +29,14 @@ module DiscourseTagging
 
       if tag_names.present?
         category = topic.category
-        tags = filter_allowed_tags(Tag.where(name: tag_names), guardian, { for_input: true, category: category, selected_tags: tag_names }).to_a
+
+        # guardian is explicitly nil cause we don't want to strip all
+        # staff tags that already passed validation
+        tags = filter_allowed_tags(Tag.where(name: tag_names), nil, {
+          for_input: true,
+          category: category,
+          selected_tags: tag_names
+        }).to_a
 
         if tags.size < tag_names.size && (category.nil? || category.tags.count == 0)
           tag_names.each do |name|
diff --git a/spec/models/tag_user_spec.rb b/spec/models/tag_user_spec.rb
index cb01f6985d3..2e4dd4bdb04 100644
--- a/spec/models/tag_user_spec.rb
+++ b/spec/models/tag_user_spec.rb
@@ -158,6 +158,36 @@ describe TagUser do
 
       end
 
+      it "correctly handles staff tags" do
+
+        staff = Fabricate(:admin)
+        topic = create_post.topic
+
+        SiteSetting.staff_tags = "foo"
+
+        result = DiscourseTagging.tag_topic_by_names(topic, Guardian.new(user), ["foo"])
+        expect(result).to eq(false)
+        expect(topic.errors[:base].length).to eq(1)
+
+        result = DiscourseTagging.tag_topic_by_names(topic, Guardian.new(staff), ["foo"])
+        expect(result).to eq(true)
+
+        topic.errors[:base].clear
+
+        result = DiscourseTagging.tag_topic_by_names(topic, Guardian.new(user), [])
+        expect(result).to eq(false)
+        expect(topic.errors[:base].length).to eq(1)
+
+        topic.reload
+
+        result = DiscourseTagging.tag_topic_by_names(topic, Guardian.new(user), ["foo", "bar"])
+        expect(result).to eq(true)
+
+        topic.reload
+        expect(topic.tags.length).to eq(2)
+
+      end
+
       it "is destroyed when a user is deleted" do
         TagUser.create!(user: user, tag: tracked_tag, notification_level: TagUser.notification_levels[:tracking])
         user.destroy!