engineering/remarkbox
1
0
Fork 0
Code Issues 3 Pull requests 1 Projects Releases Packages Wiki Activity Actions

fix: Namespace.moderators returned all members; owners now imply mod

Browse source 
moderators property returned self.enabled_users (every enabled member),
so every user who had ever posted got moderator powers: spam
approve/deny, edit/delete other users' comments, moderator Slack
notifications. Bug was universal across all namespaces — any site where
users post was affected.

Fix: moderators now returns only users with role='moderator'.
Owners now implicitly pass is_moderator() checks, since NamespaceUser
is single-role per user per namespace; this keeps owners functional
without needing a data migration.
This commit is contained in:
russell@unturf.com 2026-04-21 19:59:40 -04:00
parent e1952cb1c4
commit a5c3e36fce
1 changed files with 4 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

5
remarkbox/models/namespace.py
View file

@ -272,7 +272,7 @@ class Namespace(RBase, Base):
@property
def moderators(self):
"""Return a list of moderator role User objects."""
return self.enabled_users
return self.roles.get("moderator", [])
@property
def visible_roots(self):
@ -382,12 +382,15 @@ class Namespace(RBase, Base):
"""Return True if given user moderates this namespace, else False.
Superusers are treated as moderators on every namespace.
Owners are implicitly moderators.
"""
if user and user.authenticated:
if getattr(user, "is_superuser", False):
return True
if user in self.moderators:
return True
if user in self.owners:
return True
return False
def can_alter_node(self, node, user):