Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-06 13:08:40 +08:00
Code Packages Activity Actions
discourse/app
History
Exact
discoursebot cedbe30abf
 SECURITY: PostsController#raw_email leaks raw emails of inaccessible to mods [backport 2026.1] (#41966) 
Backport of #41962 to release/2026.1.

---

## Summary

Prevent unauthorized access to raw emails by ensuring the mod has
permission to view the underlying post before granting access to its raw
email data. This addresses an issue where members of privileged groups
could bypass visibility restrictions to view raw email content for
private messages or deleted posts.

Co-authored-by: discourse-patch-triage
<272280883+discourse-patch-triage[bot]@users.noreply.github.com>

Co-authored-by: Sam <sam.saffron@gmail.com>
2026-07-23 16:37:00 +10:00
..
assets UX: Improve post stream scrolling stability and layout control [backport 2026.1] (#38318) 2026-03-06 10:06:47 -06:00
controllers SECURITY: PostsController#raw_email leaks raw emails of inaccessible to mods [backport 2026.1] (#41966) 2026-07-23 16:37:00 +10:00
helpers SECURITY: Bind shared session key to auth token and enforce user gates [backport 2026.1] (#41691) 2026-07-14 15:48:25 +08:00
jobs SECURITY: Authorize secure-upload hotlink downloads against post user [backport 2026.1] 2026-06-30 16:27:06 +02:00
mailers UX: improve sender name in emails (#36974) 2026-01-06 15:41:01 +04:00
models SECURITY: Stale featured rows expose unlisted topic content [backport 2026.1] (#41813) 2026-07-17 09:40:52 -05:00
queries/reports FEATURE: Add admin-only reports and centralize report visibility logic 2026-01-28 17:11:14 +00:00
serializers SECURITY: Reviewable conversations expose post-voting flag PM excerpts to category moderators outside the PM [backport 2026.1] (#41531) 2026-07-07 15:37:32 -05:00
services SECURITY: Stale featured rows expose unlisted topic content [backport 2026.1] (#41813) 2026-07-17 09:40:52 -05:00
views FIX: Strip HTML from category og:description meta tag (#37322) 2026-01-27 18:16:35 +11:00