Merge pull request #2026 from codidact/cellio/2025-prevent-tag-patricide

Author: ArtOfCode-

app/controllers/tags_controller.rb

@@ -225,30 +225,34 @@ def merge
   end
 
   def nuke
-    Post.transaction do
-      AuditLog.admin_audit event_type: 'tag_nuke', related: @tag, user: current_user,
-                           comment: "#{@tag.name} (#{@tag.id})"
-
-      tables = ['posts_tags', 'categories_moderator_tags', 'categories_required_tags', 'categories_topic_tags',
-                'post_history_tags', 'suggested_edits_tags', 'suggested_edits_before_tags']
-
-      # Remove tag from caches
-      caches_sql = 'UPDATE posts INNER JOIN posts_tags ON posts.id = posts_tags.post_id ' \
-                   'SET posts.tags_cache = REPLACE(posts.tags_cache, ?, ?) ' \
-                   'WHERE posts_tags.tag_id = ?'
-      exec_sql([caches_sql, "\n- #{@tag.name}\n", "\n", @tag.id])
+    if @tag.children.any?
+      flash[:error] = 'Cannot delete a tag that has children.'
+    else
+      Post.transaction do
+        AuditLog.admin_audit event_type: 'tag_nuke', related: @tag, user: current_user,
+                             comment: "#{@tag.name} (#{@tag.id})"
+
+        tables = ['posts_tags', 'categories_moderator_tags', 'categories_required_tags', 'categories_topic_tags',
+                  'post_history_tags', 'suggested_edits_tags', 'suggested_edits_before_tags']
+
+        # Remove tag from caches
+        caches_sql = 'UPDATE posts INNER JOIN posts_tags ON posts.id = posts_tags.post_id ' \
+                     'SET posts.tags_cache = REPLACE(posts.tags_cache, ?, ?) ' \
+                     'WHERE posts_tags.tag_id = ?'
+        exec_sql([caches_sql, "\n- #{@tag.name}\n", "\n", @tag.id])
+
+        # Delete all references to the tag
+        tables.each do |tbl|
+          sql = "DELETE FROM #{tbl} WHERE tag_id = ?"
+          exec_sql([sql, @tag.id])
+        end
 
-      # Delete all references to the tag
-      tables.each do |tbl|
-        sql = "DELETE FROM #{tbl} WHERE tag_id = ?"
-        exec_sql([sql, @tag.id])
+        # Nuke it
+        @tag.destroy
       end
 
-      # Nuke it
-      @tag.destroy
+      flash[:success] = "Deleted #{@tag.name}"
     end
-
-    flash[:success] = "Deleted #{@tag.name}"
     redirect_to category_tags_path(@category)
   end
 

app/views/tags/nuke_warning.html.erb

@@ -6,6 +6,12 @@
 
 <h1>Delete tag <%= @tag.name %></h1>
 
+<% if @tag.children.any? %>
+<div class="notice is-warning has-color-yellow-900">
+  <p>Tags with children cannot be deleted. Please reparent the children first.</p>
+</div>
+<% else %>
+
 <div class="notice is-danger has-color-red-900">
   <p>
     Deleting a tag results in making it seem to have never existed in the first place. No record will be kept of the tag.
@@ -27,3 +33,4 @@
             role: 'button' do %>
   I understand, delete <%= @tag.name %>
 <% end %>
+<% end %>