Fix wizard locales for non-staff

plugin.rb

@@ -191,5 +191,21 @@ after_initialize do
     end
   end
   
+  ## TODO: We shouldn't be overriding the entire method here. Make this more lightweight.
+  add_to_class(:extra_locales_controller, :show) do
+    bundle = params[:bundle]
+    
+    unless URI(request.referer).path.include? '/w/'
+      raise Discourse::InvalidAccess.new if bundle !~ /^(admin|wizard)$/ || !current_user&.staff?
+    end
+
+    if params[:v]&.size == 32
+      hash = ExtraLocalesController.bundle_js_hash(bundle)
+      immutable_for(24.hours) if hash == params[:v]
+    end
+
+    render plain: ExtraLocalesController.bundle_js(bundle), content_type: "application/javascript"
+  end
+
   DiscourseEvent.trigger(:custom_wizard_ready)
 end

views/layouts/wizard.html.erb

@@ -17,7 +17,7 @@
     <%= preload_script "wizard-plugin" %>
     <%= preload_script "pretty-text-bundle" %>
     <%= preload_script "locales/#{I18n.locale}" %>
-    <script src="<%= Discourse.base_uri %>/extra-locales/wizard"></script>
+    <script src="<%= ExtraLocalesController.url("wizard") %>"></script>
     <%= csrf_meta_tags %>
 
     <%- unless customization_disabled? %>