[$50] Prod - can't delete discussion

[jmgasper]

@atelomycterus - We're running into a problem on prod.

There was a spam post added that we want to delete, but no one seems to be able to. All permissions look fine for the admins, but it still gives us a 403, which is strange. We've tried clearing cache, logging out / in, and nothing seems to help.

[jmgasper]

Challenge https://www.topcoder.com/challenges/5adcc53a-e371-4508-809c-335189a1584e has been created for this ticket.

This is an automated message for ghostar via Topcoder X

[jmgasper]

Challenge https://www.topcoder.com/challenges/5adcc53a-e371-4508-809c-335189a1584e has been assigned to obog.

This is an automated message for ghostar via Topcoder X

[atelomycterus]

@jmgasper I've tested it in DEV and got the same error but I can delete discussions using REST API ('/discussions/{id}'):

After deleting if you go to the discussion then the message should be displayed:

I've looked at the code. The both controllers (DiscussionsController and DiscussionsAPIController) verify the current user's permission ('Vanilla.Discussions.Delete') in a category. They call the same method, but there are differences in the call parameters. I'll debug it today locally.

[atelomycterus]

@jmgasper DiscussionID is shown in URL ☝️

[atelomycterus]

@jmgasper The issue was caused by 'target' query param. Please apply PR-#460 and I'll test it. Thanks.

[atelomycterus]

Before deploying PR in DEV:
Author or any users with 'Vanilla,Discussions.Delete' can't delete discussions

[jmgasper]

@atelomycterus - Done, deploying now, thanks.

[atelomycterus]

@jmgasper Verified in DEV. It works as expected.

After deleting a discussion:

Using a discussion link:

Normal user without 'Vanilla.Discussions.Delete' permission, copy&paste a discussion delete link in a browser address bar: