diff --git a/app/controllers/concerns/caching_headers.rb b/app/controllers/concerns/caching_headers.rb index 8159871c2..1adb3b5c0 100644 --- a/app/controllers/concerns/caching_headers.rb +++ b/app/controllers/concerns/caching_headers.rb @@ -37,6 +37,13 @@ module CachingHeaders ) end + def unset_cache_control_headers + RequestStore.store[:edge_caching_in_place] = false + response.headers["Cache-Control"] = nil + response.headers["X-Accel-Expires"] = nil + response.headers["Surrogate-Control"] = nil + end + # Sets Surrogate-Key HTTP header with one or more keys strips session data # from the request. def set_surrogate_key_header(*surrogate_keys) diff --git a/app/controllers/stories_controller.rb b/app/controllers/stories_controller.rb index 960e0562b..98f0eed13 100644 --- a/app/controllers/stories_controller.rb +++ b/app/controllers/stories_controller.rb @@ -50,6 +50,14 @@ class StoriesController < ApplicationController private + # for spam content we need to remove cache control headers to access current_user to check admin access + # so that admins could have access to spam articles and profiles + def check_admin_access + unset_cache_control_headers if user_signed_in? + is_admin = user_signed_in? && current_user&.any_admin? + not_found unless is_admin + end + def set_user_limit @user_limit = 50 end @@ -185,7 +193,9 @@ class StoriesController < ApplicationController end not_found if @user.username.include?("spam_") && @user.decorate.fully_banished? not_found unless @user.registered - not_found if @user.spam? + + check_admin_access if @user.spam? + if !user_signed_in? && (@user.suspended? && @user.has_no_published_content?) not_found end @@ -264,7 +274,8 @@ class StoriesController < ApplicationController def assign_article_show_variables not_found if permission_denied? not_found unless @article.user - not_found if @article.user.spam? + + check_admin_access if @article.user.spam? @pinned_article_id = PinnedArticle.id diff --git a/app/views/articles/show.html.erb b/app/views/articles/show.html.erb index b0fa4ca1e..3a65d3dcb 100644 --- a/app/views/articles/show.html.erb +++ b/app/views/articles/show.html.erb @@ -122,6 +122,9 @@