FEATURE: Allow safe mode to be disabled

app/controllers/application_controller.rb

@@ -299,6 +299,8 @@ class ApplicationController < ActionController::Base
   SAFE_MODE = "safe_mode"
 
   def resolve_safe_mode
+    return unless SiteSetting.enable_safe_mode?
+
     safe_mode = params[SAFE_MODE]
     if safe_mode
       request.env[NO_CUSTOM] = !!safe_mode.include?(NO_CUSTOM)

app/controllers/safe_mode_controller.rb

@@ -1,5 +1,7 @@
 class SafeModeController < ApplicationController
   layout 'no_ember'
+  before_action :ensure_safe_mode_enabled
+
   skip_before_action :preload_json, :check_xhr
 
   def index
@@ -18,4 +20,11 @@ class SafeModeController < ApplicationController
       redirect_to safe_mode_path
     end
   end
+
+  protected
+
+  def ensure_safe_mode_enabled
+    raise Discourse::NotFound unless SiteSetting.enable_safe_mode?
+  end
+
 end

app/views/common/_discourse_javascript.html.erb

@@ -50,7 +50,7 @@
     Discourse.start();
     Discourse.set('assetVersion','<%= Discourse.assets_digest %>');
     Discourse.Session.currentProp("disableCustomCSS", <%= loading_admin? %>);
-    <%- if params["safe_mode"] %>
+    <%- if SiteSetting.enable_safe_mode? && params["safe_mode"] %>
     Discourse.Session.currentProp("safe_mode", <%= normalized_safe_mode.inspect.html_safe %>);
     <%- end %>
     Discourse.HighlightJSPath = <%= HighlightJs.path.inspect.html_safe %>;

config/locales/server.en.yml

@@ -1259,6 +1259,7 @@ en:
     top_topics_formula_least_likes_per_post_multiplier: "value of least likes per post multiplier (n) in top topics formula: `log(views_count) * 2 + op_likes_count * 0.5 + LEAST(likes_count / posts_count, (n)) + 10 + log(posts_count)`"
 
     rebake_old_posts_count: "Number of old posts to be rebaked every 15 minutes."
+    enable_safe_mode: "Allow users to enter safe mode to debug plugins."
 
     rate_limit_create_topic: "After creating a topic, users must wait (n) seconds before creating another topic."
     rate_limit_create_post: "After posting, users must wait (n) seconds before creating another post."

config/site_settings.yml

@@ -1201,6 +1201,9 @@ developer:
   bootstrap_error_pages:
     hidden: true
     default: false
+  enable_safe_mode:
+    default: true
+    client: true
 
 embedding:
   feed_polling_enabled:

spec/requests/safe_mode_controller_spec.rb

@@ -5,9 +5,17 @@ RSpec.describe SafeModeController do
     context 'when no params are given' do
       it 'should redirect back to safe mode page' do
         post '/safe-mode'
-
         expect(response.status).to redirect_to(safe_mode_path)
       end
     end
+
+    context 'when safe mode is not enabled' do
+      it 'should raise an error' do
+        SiteSetting.enable_safe_mode = false
+        post '/safe-mode'
+        expect(response.status).to eq(404)
+      end
+    end
+
   end
 end