Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-06 13:08:40 +08:00
Code Packages Activity Actions
discourse/app
History
Exact
Isaac Janzen f1dcbb24e0
 SECURITY: Private UserField value disclosure via directory_items order sort side-channel (#41598) 
## Summary

Prevent unauthenticated disclosure of private user custom field values
via the directory items sort order. The fix restricts the `order`
parameter to public fields for non-staff users and falls back to default
sorting when an unauthorized field is requested.

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/1334

Co-authored-by: discourse-patch-triage
<272280883+discourse-patch-triage[bot]@users.noreply.github.com>
2026-07-09 21:52:51 -05:00
..
assets DEV: Introduce a category scope enum for flexible category selection (#41505) 2026-07-08 15:54:10 +08:00
controllers SECURITY: Private UserField value disclosure via directory_items order sort side-channel (#41598) 2026-07-09 21:52:51 -05:00
helpers FEATURE: Show bounce rate and average session duration on the dashboard (#40936) 2026-07-03 10:49:32 +08:00
jobs FIX: Run nested replies stats job on all topics when nested is default (#41510) 2026-07-07 14:30:53 -05:00
mailers FEATURE: Log in with a one-time email code (#40804) 2026-06-17 12:34:48 -07:00
models SECURITY: Unsanitized TagLocalization Descriptions (#41555) 2026-07-08 14:42:13 -05:00
queries/reports DEV: Remove reporting_improvements upcoming change (#41259) 2026-07-01 07:52:02 +08:00
serializers FIX: Omit inaccessible reply target post numbers from post revision history (#41547) 2026-07-08 11:41:43 -05:00
services FIX: Return database connections to the pool after dashboard builds (#41583) 2026-07-10 09:54:40 +08:00
views FIX: improve the reliability of chat sounds (#41373) 2026-07-02 18:52:41 -04:00