fix: prevent users from seeing their own flags (#4167)

Author: SychO9

extensions/flags/src/Access/ScopeFlagVisibility.php

@@ -37,10 +37,8 @@ public function __invoke(User $actor, Builder $query): void
                     if ($actor->hasPermission('discussion.viewFlags')) {
                         $query->orWhereDoesntHave('post.discussion.tags');
                     }
-                }
-
-                if (! $actor->hasPermission('discussion.viewFlags')) {
-                    $query->orWhere('flags.user_id', $actor->id);
+                } elseif (! $actor->hasPermission('discussion.viewFlags')) {
+                    $query->whereRaw('1 = 0');
                 }
             });
     }

extensions/flags/tests/integration/api/flags/ListTest.php

@@ -96,7 +96,7 @@ public function admin_can_see_one_flag_per_visible_post()
     }
 
     #[Test]
-    public function regular_user_sees_own_flags_of_visible_posts()
+    public function regular_user_does_not_see_own_flags_of_visible_posts()
     {
         $response = $this->send(
             $this->request('GET', '/api/flags', [
@@ -109,7 +109,7 @@ public function regular_user_sees_own_flags_of_visible_posts()
         $data = json_decode($response->getBody()->getContents(), true)['data'];
 
         $ids = Arr::pluck($data, 'id');
-        $this->assertEqualsCanonicalizing(['2', '4'], $ids);
+        $this->assertEqualsCanonicalizing([], $ids);
     }
 
     #[Test]

extensions/flags/tests/integration/api/flags/ListWithTagsTest.php

@@ -122,7 +122,7 @@ public function admin_can_see_one_flag_per_post()
     }
 
     #[Test]
-    public function regular_user_sees_own_flags()
+    public function regular_user_does_not_see_own_flags()
     {
         $response = $this->send(
             $this->request('GET', '/api/flags', [
@@ -135,7 +135,7 @@ public function regular_user_sees_own_flags()
         $data = json_decode($response->getBody()->getContents(), true)['data'];
 
         $ids = Arr::pluck($data, 'id');
-        $this->assertEqualsCanonicalizing(['2', '4'], $ids);
+        $this->assertEqualsCanonicalizing([], $ids);
     }
 
     #[Test]

extensions/flags/tests/integration/api/posts/IncludeFlagsVisibilityTest.php

@@ -144,7 +144,7 @@ public static function listFlagsIncludesDataProvider(): array
             'user_with_general_permission_sees_where_unrestricted_tag' => [2, [6, 7, 8]],
             'user_with_tag1_permission_sees_tag1_flags' => [3, [1, 2, 3, 4, 5]],
             'normal_user_sees_none' => [4, []],
-            'normal_user_sees_own' => [5, [2, 7, 4, 8]],
+            'normal_user_does_not_see_own' => [5, []],
         ];
     }
 }