From c71afdfdb0da957bc597ea43107458b68218bf44 Mon Sep 17 00:00:00 2001 From: Sam Date: Fri, 25 Feb 2022 11:20:54 +1100 Subject: [PATCH] FIX: avoid validations when destroying posts (#16049) Previously email validations could fire when deleting posts if for certain reasons any user validations fail on the user objects This kind of condition could happen in core due to a corruption of a user record, or via a plugin that introduces a new validation on User --- lib/post_destroyer.rb | 3 +-- spec/lib/post_destroyer_spec.rb | 12 ++++++++++++ 2 files changed, 13 insertions(+), 2 deletions(-) diff --git a/lib/post_destroyer.rb b/lib/post_destroyer.rb index f29acb7acf8..1ad6d9bcf70 100644 --- a/lib/post_destroyer.rb +++ b/lib/post_destroyer.rb @@ -388,8 +388,7 @@ class PostDestroyer UserStatCountUpdater.decrement!(@post) if @post.created_at == author.last_posted_at - author.last_posted_at = author.posts.order('created_at DESC').first.try(:created_at) - author.save! + author.update_column(:last_posted_at, author.posts.order('created_at DESC').first.try(:created_at)) end if @post.is_first_post? && @post.topic && !@post.topic.private_message? diff --git a/spec/lib/post_destroyer_spec.rb b/spec/lib/post_destroyer_spec.rb index 7b8426e4193..0120f6bab24 100644 --- a/spec/lib/post_destroyer_spec.rb +++ b/spec/lib/post_destroyer_spec.rb @@ -185,6 +185,18 @@ describe PostDestroyer do .and change { post.topic.user_id }.to(Discourse.system_user.id) end + it "bypassed validation when updating users" do + post = create_post + + # ensure user would fail validations + UserEmail.where(user_id: post.user_id).delete_all + + PostDestroyer.new(admin, post.reload).destroy + PostDestroyer.new(admin, post.reload, force_destroy: true).destroy + + expect(Post.with_deleted.find_by(id: post.id)).to eq(nil) + end + describe "post_count recovery" do before do post