Core: Applying the "reply to discussions" permission to a tag may break the "lock" mode

[matteocontrini]

Bug Report

Current Behavior
If you have a tag where you explicitly set that users can reply to discussions, users may be able to reply to discussions that are locked.

Steps to Reproduce

1. Log in as an admin
2. Create a new "restriction by tag" for any tag (X) in the Permissions admin page
3. Set the permission that allows users to reply to discussions with tag X
4. Create a new discussion with tag X and lock it
5. Disable and re-enable the lock extension (this is required to reproduce the issue)
6. Log in as a regular user
7. Try to reply to the created discussion in tag X and succeed

Expected Behavior
Users should not be able to reply to discussions that are locked (unless they have the "canLock" permission).

Screenshots

Admin view:

User view:

Environment
Reproduced on beta.flarum.site and nightly.flarum.site.

[askvortsov1]

This will be fixed with the policy rewrite I'm working on right now.

[matteocontrini]

Hello, is there a chance to have this fixed for the next beta? It's the only issue marked as "critical" (EDIT: currently) but it's been almost a year since it's been reported... Thanks 😃

[datitisev]

I think this issue is more complicated than it seems. We've discussed multiple ways on fixing it, and the policy refactor PR may fix it.