Discource-C
/
discourse
mirror of https://github.com/discourse/discourse.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

FIX: only staff can access 'resend all invites' feature

This commit is contained in:
Arpit Jalan 2016-06-07 10:57:08 +05:30
parent a9c6df198c
commit b1a94049e0
3 changed files with 6 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
app/assets/javascripts/discourse/controllers/user-invited-show.js.es6
View File

@ -35,7 +35,7 @@ export default Ember.Controller.extend({
inviteRedeemed: Em.computed.equal('filter', 'redeemed'), inviteRedeemed: Em.computed.equal('filter', 'redeemed'),
showReinviteAllButton: function() { showReinviteAllButton: function() {
return (this.get('filter') === "pending" && this.get('model').invites.length > 4); return (this.get('filter') === "pending" && this.get('model').invites.length > 4 && this.currentUser.get('staff'));
}.property('filter'), }.property('filter'),
/** /**

6
app/controllers/invites_controller.rb
View File

@ -141,14 +141,10 @@ class InvitesController < ApplicationController
end end
def resend_all_invites def resend_all_invites
guardian.ensure_can_invite_to_forum! guardian.ensure_can_resend_all_invites!(current_user)
RateLimiter.new(current_user, "resend-all-invites-per-day", 1, 1.day).performed!
Invite.resend_all_invites_from(current_user.id) Invite.resend_all_invites_from(current_user.id)
render nothing: true render nothing: true
rescue RateLimiter::LimitExceeded
render_json_error(I18n.t("rate_limiter.slow_down"))
end end
def check_csv_chunk def check_csv_chunk

4
lib/guardian.rb
View File

@ -246,6 +246,10 @@ class Guardian
user.staff? user.staff?
end end
def can_resend_all_invites?(user)
user.staff?
end
def can_see_private_messages?(user_id) def can_see_private_messages?(user_id)
is_admin? || (authenticated? && @user.id == user_id) is_admin? || (authenticated? && @user.id == user_id)
end end