Discourse/discourse
Discourse/discourse
2
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2025-09-09 12:21:04 +08:00
Code Packages Activity Actions 1

SECURITY: do not disclose topic titles on /unsubscribed page to unauthorized users

Browse source
This commit is contained in:
Arpit Jalan 2018-04-15 17:59:58 +05:30
parent c28c5083e0
commit a8a12eb2d9
1 changed files with 3 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

4
app/controllers/email_controller.rb
View file

@ -110,8 +110,10 @@ class EmailController < ApplicationController
def unsubscribed
@email = params[:email]
raise Discourse::NotFound if !User.find_by_email(params[:email])
user = User.find_by_email(params[:email])
raise Discourse::NotFound unless user
@topic = Topic.find_by(id: params[:topic_id].to_i) if params[:topic_id]
raise Discourse::NotFound unless Guardian.new(user).can_see?(@topic)
end
end