diff --git a/lib/guardian.rb b/lib/guardian.rb index 83387fc7bae..e6a4ad76ac1 100644 --- a/lib/guardian.rb +++ b/lib/guardian.rb @@ -472,15 +472,20 @@ class Guardian from_system = @user.is_system_user? # Must be a valid target - (target_is_group || target_is_user) && + return false if !(target_is_group || target_is_user) + + # Users can send messages to certain groups with the `everyone` messageable_level + # even if they are not in personal_message_enabled_groups + group_is_messageable = target_is_group && Group.messageable(@user).where(id: target.id).exists? + # User is authenticated and can send PMs, this can be covered by trust levels as well via AUTO_GROUPS - can_send_private_messages?(notify_moderators: notify_moderators) && + (can_send_private_messages?(notify_moderators: notify_moderators) || group_is_messageable) && # User disabled private message (is_staff? || target_is_group || target.user_option.allow_private_messages) && # Can't send PMs to suspended users (is_staff? || target_is_group || !target.suspended?) && # Check group messageable level - (from_system || target_is_user || Group.messageable(@user).where(id: target.id).exists? || notify_moderators) && + (from_system || target_is_user || group_is_messageable || notify_moderators) && # Silenced users can only send PM to staff (!is_silenced? || target.staff?) end diff --git a/spec/lib/guardian_spec.rb b/spec/lib/guardian_spec.rb index 22d3b85f617..f386344328e 100644 --- a/spec/lib/guardian_spec.rb +++ b/spec/lib/guardian_spec.rb @@ -364,9 +364,9 @@ RSpec.describe Guardian do end end - it "allows TL0 to message group with messageable_level = everyone" do + it "allows TL0 to message group with messageable_level = everyone regardless of personal_message_enabled_groups" do group.update!(messageable_level: Group::ALIAS_LEVELS[:everyone]) - SiteSetting.personal_message_enabled_groups = Group::AUTO_GROUPS[:trust_level_0] + SiteSetting.personal_message_enabled_groups = Group::AUTO_GROUPS[:trust_level_1] expect(Guardian.new(trust_level_0).can_send_private_message?(group)).to eq(true) expect(Guardian.new(user).can_send_private_message?(group)).to eq(true) end diff --git a/spec/requests/groups_controller_spec.rb b/spec/requests/groups_controller_spec.rb index 493a4cc599b..33ff0daf1c5 100644 --- a/spec/requests/groups_controller_spec.rb +++ b/spec/requests/groups_controller_spec.rb @@ -639,6 +639,16 @@ RSpec.describe GroupsController do get "/groups/#{group.name}/messageable.json" expect(response.status).to eq(200) + body = response.parsed_body + expect(body["messageable"]).to eq(true) + + group.update!( + messageable_level: Group::ALIAS_LEVELS[:only_admins], + ) + + get "/groups/#{group.name}/messageable.json" + expect(response.status).to eq(200) + body = response.parsed_body expect(body["messageable"]).to eq(false) end