mirror of
https://github.com/discourse/discourse.git
synced 2025-02-07 11:58:27 +00:00
96b725a11c
In a PM, if a user has made a post, and is later removed from the PM, they can still edit their own post. This can be done either if they happen to have a composer open in an active tab, or by just manually sending an HTTP request. The post guardian is missing a basic check, can_see_post_topic? when we determine whether a user can edit a post or not. This basic check is already in place when we determine whether a user can see the post in the first place. This PR adds in the missing check, so that if the user tries to edit their post after being removed, they'll receive a 403. It also adds a MessageBus message scoped to the affected user and topic when they are removed from the PM, which will redirect them to their inbox. This helps avoid a stale tab where they are still in the PM which they by right can now no longer see.