discourse · brrusselburg · Aug 5, 2025 · Feb 19, 2025 · Feb 20, 2025 · Feb 20, 2025
diff --git a/app/assets/javascripts/admin/addon/routes/admin-logs-screened-ip-addresses.js b/app/assets/javascripts/admin/addon/routes/admin-logs-screened-ip-addresses.js
@@ -1,6 +1,15 @@
+import { service } from "@ember/service";
 import DiscourseRoute from "discourse/routes/discourse";
 
 export default class AdminLogsScreenedIpAddressesRoute extends DiscourseRoute {
+  @service currentUser;
+
+  beforeModel() {
+    if (!this.currentUser.can_see_ip) {
+      this.transitionTo("adminLogs.staffActionLogs");
+    }
+  }
+
   setupController() {
     return this.controllerFor("adminLogsScreenedIpAddresses").show();
   }

diff --git a/app/assets/javascripts/admin/addon/templates/logs.gjs b/app/assets/javascripts/admin/addon/templates/logs.gjs
@@ -31,10 +31,12 @@ export default RouteTemplate(
             @label="admin.config.staff_action_logs.sub_pages.screened_emails.title"
           />
         {{/if}}
-        <NavItem
-          @route="adminLogs.screenedIpAddresses"
-          @label="admin.config.staff_action_logs.sub_pages.screened_ips.title"
-        />
+        {{#if @controller.currentUser.can_see_ip}}
+          <NavItem
+            @route="adminLogs.screenedIpAddresses"
+            @label="admin.config.staff_action_logs.sub_pages.screened_ips.title"
+          />
+        {{/if}}
         <NavItem
           @route="adminLogs.screenedUrls"
           @label="admin.config.staff_action_logs.sub_pages.screened_urls.title"

diff --git a/app/assets/javascripts/admin/addon/templates/user-index.gjs b/app/assets/javascripts/admin/addon/templates/user-index.gjs
@@ -228,35 +228,39 @@ export default RouteTemplate(
         />
       </div>
 
-      <div class="display-row last-ip">
-        <div class="field">{{i18n "user.ip_address.title"}}</div>
-        <div class="value">{{@controller.model.ip_address}}</div>
-        <div class="controls">
-          {{#if @controller.currentUser.staff}}
-            {{#if @controller.model.ip_address}}
-              <IpLookup
-                @ip={{@controller.model.ip_address}}
-                @userId={{@controller.model.id}}
-              />
+      {{#if @controller.model.include_ip}}
+        <div class="display-row last-ip">
+          <div class="field">{{i18n "user.ip_address.title"}}</div>
+          <div class="value">{{@controller.model.ip_address}}</div>
+          <div class="controls">
+            {{#if @controller.currentUser.can_see_ip}}
+              {{#if @controller.model.ip_address}}
+                <IpLookup
+                  @ip={{@controller.model.ip_address}}
+                  @userId={{@controller.model.id}}
+                />
+              {{/if}}
             {{/if}}
-          {{/if}}
+          </div>
         </div>
-      </div>
+      {{/if}}
 
-      <div class="display-row registration-ip">
-        <div class="field">{{i18n "user.registration_ip_address.title"}}</div>
-        <div class="value">{{@controller.model.registration_ip_address}}</div>
-        <div class="controls">
-          {{#if @controller.currentUser.staff}}
-            {{#if @controller.model.registration_ip_address}}
-              <IpLookup
-                @ip={{@controller.model.registration_ip_address}}
-                @userId={{@controller.model.id}}
-              />
+      {{#if @controller.model.include_ip}}
+        <div class="display-row registration-ip">
+          <div class="field">{{i18n "user.registration_ip_address.title"}}</div>
+          <div class="value">{{@controller.model.registration_ip_address}}</div>
+          <div class="controls">
+            {{#if @controller.currentUser.can_see_ip}}
+              {{#if @controller.model.registration_ip_address}}
+                <IpLookup
+                  @ip={{@controller.model.registration_ip_address}}
+                  @userId={{@controller.model.id}}
+                />
+              {{/if}}
             {{/if}}
-          {{/if}}
+          </div>
         </div>
-      </div>
+      {{/if}}
 
       {{#if @controller.showBadges}}
         <div class="display-row">

diff --git a/app/controllers/admin/screened_ip_addresses_controller.rb b/app/controllers/admin/screened_ip_addresses_controller.rb
@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 class Admin::ScreenedIpAddressesController < Admin::StaffController
+  before_action :can_see_ip
   before_action :fetch_screened_ip_address, only: %i[update destroy]
 
   def index
@@ -49,6 +50,10 @@ def destroy
 
   private
 
+  def can_see_ip
+    raise Discourse::InvalidAccess.new if !guardian.can_see_ip?
+  end
+
   def allowed_params
     params.require(:ip_address)
     params.permit(:ip_address, :action_name)

diff --git a/app/controllers/admin/users_controller.rb b/app/controllers/admin/users_controller.rb
@@ -51,6 +51,7 @@ def show
       root: false,
       similar_users_count: @user.similar_users.count,
       include_silence_reason: true,
+      include_ip: guardian.can_see_ip?,
     )
   end
 
@@ -438,6 +439,7 @@ def tl3_requirements
 
   def ip_info
     params.require(:ip)
+    raise Discourse::InvalidAccess.new unless guardian.can_see_ip?
 
     render json: DiscourseIpInfo.get(params[:ip], resolve_hostname: true)
   end

diff --git a/app/serializers/admin_user_serializer.rb b/app/serializers/admin_user_serializer.rb
@@ -8,7 +8,8 @@ class AdminUserSerializer < AdminUserListSerializer
              :can_deactivate,
              :can_approve,
              :ip_address,
-             :registration_ip_address
+             :registration_ip_address,
+             :include_ip
 
   has_one :single_sign_on_record, serializer: SingleSignOnRecordSerializer, embed: :objects
 
@@ -40,7 +41,19 @@ def registration_ip_address
     object.registration_ip_address.try(:to_s)
   end
 
+  def include_ip_address?
+    scope.can_see_ip?
+  end
+
+  def include_registration_ip_address?
+    scope.can_see_ip?
+  end
+
   def include_can_be_deleted?
     true
   end
+
+  def include_ip
+    @options[:include_ip]
+  end
 end
diff --git a/app/serializers/current_user_serializer.rb b/app/serializers/current_user_serializer.rb
@@ -81,7 +81,8 @@ class CurrentUserSerializer < BasicUserSerializer
              :can_localize_content?,
              :effective_locale,
              :use_reviewable_ui_refresh,
-             :use_experimental_sidebar_messages_count
+             :use_experimental_sidebar_messages_count,
+             :can_see_ip
 
   delegate :user_stat, to: :object, private: true
   delegate :any_posts, :draft_count, :pending_posts_count, :read_faq?, to: :user_stat
@@ -361,4 +362,12 @@ def use_experimental_sidebar_messages_count
   def include_use_reviewable_ui_refresh?
     scope.can_see_review_queue?
   end
+
+  def can_see_ip
+    scope.can_see_ip?
+  end
+
+  def include_can_see_ip?
+    object.admin? || (object.moderator? && SiteSetting.moderators_view_ips)
+  end
 end
diff --git a/app/serializers/user_history_serializer.rb b/app/serializers/user_history_serializer.rb
@@ -40,4 +40,9 @@ def previous_value
       nil
     end
   end
+
+  def ip_address
+    return nil unless scope.can_see_ip?
+    object.ip_address.try(:to_s)
+  end
 end
diff --git a/config/locales/server.en.yml b/config/locales/server.en.yml
@@ -1921,6 +1921,7 @@ en:
     redirect_users_to_top_page: "Automatically redirect new and long absent users to the top page. Only applies when 'top' is present in the 'top menu' site setting."
     top_page_default_timeframe: "Default top page time period for anonymous users (automatically adjusts for logged in users based on their last visit)."
     moderators_view_emails: "Allow moderators to view user email addresses."
+    moderators_view_ips: "Allow moderators to view user ip addresses."
     prioritize_username_in_ux: "Show username first on user page, user card and posts (when disabled name is shown first)"
     enable_rich_text_paste: "Enable automatic HTML to Markdown conversion when pasting text into the composer."
     send_old_credential_reminder_days: "Remind about old credentials after days"

diff --git a/config/site_settings.yml b/config/site_settings.yml
@@ -2581,6 +2581,9 @@ security:
   moderators_view_emails:
     client: true
     default: false
+  moderators_view_ips:
+    default: true
+    client: true
   non_crawler_user_agents:
     hidden: true
     default: "trident|webkit|gecko|chrome|safari|msie|opera|goanna|discourse"

diff --git a/lib/guardian.rb b/lib/guardian.rb
@@ -500,6 +500,13 @@ def can_see_emails?
     SiteSetting.moderators_view_emails && is_moderator?
   end
 
+  def can_see_ip?
+    return true if is_admin?
+    return true if is_moderator? && SiteSetting.moderators_view_ips
+
+    false
+  end
+
   def can_mute_user?(target_user)
     can_mute_users? && @user.id != target_user.id && !target_user.staff?
   end

diff --git a/spec/lib/guardian_spec.rb b/spec/lib/guardian_spec.rb
@@ -3286,6 +3286,30 @@
     end
   end
 
+  describe "#can_see_ip?" do
+    let(:guardian_admin) { Guardian.new(admin) }
+    let(:guardian_moderator) { Guardian.new(moderator) }
+
+    context "when user is an admin" do
+      it "returns true" do
+        expect(guardian_admin.can_see_ip?).to eq(true)
+      end
+    end
+
+    context "when user is a moderator" do
+      before { SiteSetting.moderators_view_ips = true }
+
+      it "returns true if moderators_view_ips is enabled" do
+        expect(guardian_moderator.can_see_ip?).to eq(true)
+      end
+
+      it "returns false if moderators_view_ips is disabled" do
+        SiteSetting.moderators_view_ips = false
+        expect(guardian_moderator.can_see_ip?).to eq(false)
+      end
+    end
+  end
+
   describe "#is_developer?" do
     after { Developer.rebuild_cache }
 

diff --git a/spec/requests/api/schemas/json/admin_user_response.json b/spec/requests/api/schemas/json/admin_user_response.json
@@ -494,6 +494,9 @@
     },
     "external_ids": {
       "type": "object"
+    },
+    "include_ip": {
+      "type": "boolean"
     }
   },
   "required": [
@@ -553,6 +556,7 @@
     "suspended_by",
     "silenced_by",
     "groups",
-    "external_ids"
+    "external_ids",
+    "include_ip"
   ]
 }
diff --git a/spec/serializers/current_user_serializer_spec.rb b/spec/serializers/current_user_serializer_spec.rb
@@ -331,6 +331,38 @@
     end
   end
 
+  describe "#can_see_ip" do
+    let(:payload) { serializer.as_json }
+
+    context "when user is an admin" do
+      let(:user) { Fabricate(:admin) }
+
+      it "includes can_see_ip as true" do
+        expect(payload[:can_see_ip]).to eq(true)
+      end
+    end
+
+    context "when user is a moderator and moderators_view_ips is enabled" do
+      let(:user) { Fabricate(:moderator) }
+
+      before { SiteSetting.moderators_view_ips = true }
+
+      it "includes can_see_ip as true" do
+        expect(payload[:can_see_ip]).to eq(true)
+      end
+    end
+
+    context "when user is a moderator and moderators_view_ips is disabled" do
+      let(:user) { Fabricate(:moderator) }
+
+      before { SiteSetting.moderators_view_ips = false }
+
+      it "does not include can_see_ip" do
+        expect(payload).not_to have_key(:can_see_ip)
+      end
+    end
+  end
+
   describe "#featured_topic" do
     fab!(:featured_topic, :topic)