Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-06 13:08:40 +08:00
Code Packages Activity Actions
discourse/app/controllers
History
Exact
discoursebot cedbe30abf
 SECURITY: PostsController#raw_email leaks raw emails of inaccessible to mods [backport 2026.1] (#41966) 
Backport of #41962 to release/2026.1.

---

## Summary

Prevent unauthorized access to raw emails by ensuring the mod has
permission to view the underlying post before granting access to its raw
email data. This addresses an issue where members of privileged groups
could bypass visibility restrictions to view raw email content for
private messages or deleted posts.

Co-authored-by: discourse-patch-triage
<272280883+discourse-patch-triage[bot]@users.noreply.github.com>

Co-authored-by: Sam <sam.saffron@gmail.com>
2026-07-23 16:37:00 +10:00
..
admin SECURITY: block cross-site backup traversal in multisite local storage [backport 2026.1] 2026-05-19 00:26:55 +01:00
users FIX: Delete destination_url cookie when it's used to set origin param during redirect to social auth (#36194) 2025-11-25 09:15:03 -06:00
about_controller.rb
application_controller.rb DEV: Add /dev-mode endpoint for MiniProfiler auth cookie (#37027) 2026-01-12 10:01:20 +08:00
associated_groups_controller.rb
badges_controller.rb
bookmarks_controller.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
bootstrap_controller.rb DEV: Use Rails to render site-settings for qunit tests (#37105) 2026-01-14 12:25:12 +00:00
categories_controller.rb SECURITY: Limit Category search term and word count [backport 2026.1] (#41627) 2026-07-15 08:50:00 -05:00
clicks_controller.rb SECURITY: Missing visibility check in click tracking endpoint [backport 2026.1] (#41148) 2026-06-24 15:47:50 +10:00
composer_controller.rb SECURITY: Respect group member visibility for counts [backport 2026.1] (#41420) 2026-07-06 12:47:49 +08:00
composer_messages_controller.rb SECURITY: Whisper metadata disclosure via stale TopicLinks [backport 2026.1] (#41145) 2026-06-24 15:51:51 +10:00
csp_reports_controller.rb
dev_mode_controller.rb DEV: Add /dev-mode endpoint for MiniProfiler auth cookie (#37027) 2026-01-12 10:01:20 +08:00
directory_columns_controller.rb
directory_items_controller.rb SECURITY: Private UserField value disclosure via directory_items order sort side-channel [backport 2026.1] (#41601) 2026-07-09 21:53:32 -05:00
do_not_disturb_controller.rb
drafts_controller.rb DEV: Better protection for drafts 2026-01-28 17:11:14 +00:00
edit_directory_columns_controller.rb
email_controller.rb FEATURE: implement RFC 8058 for email unsubscribe (#33392) 2025-07-01 11:01:13 +10:00
embed_controller.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
emojis_controller.rb DEV: discourse-emojis gem (#31408) 2025-03-03 13:09:08 +01:00
exceptions_controller.rb
export_csv_controller.rb SECURITY: Prevent moderators from exporting admin-only reports via CSV [backport 2026.1] 2026-03-31 15:12:50 +01:00
extra_locales_controller.rb DEV: Refactor locale bundle loading (#37114) 2026-01-16 11:45:14 +00:00
finish_installation_controller.rb FIX: Redirect to wizard when setting up new instance using Discourse ID (#36993) 2026-01-07 10:19:17 -05:00
form_templates_controller.rb SECURITY: Scope form template endpoints to accessible categories [backport 2026.1] 2026-05-19 00:26:55 +01:00
forums_controller.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
groups_controller.rb SECURITY: mentionable/messageable endpoints bypassing visibility controls [backport 2026.1] (#41523) 2026-07-07 14:38:45 -05:00
hashtags_controller.rb
highlight_js_controller.rb FEATURE: User fields required for existing users - Part 2 (#27172) 2024-06-25 19:32:18 +08:00
home_page_controller.rb DEV: Show login-required splash in root route (take 2) (#32629) 2025-05-14 11:25:43 -04:00
inline_onebox_controller.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
invites_controller.rb SECURITY: Gate staged user fields on email verification [backport 2026.1] 2026-03-31 15:12:50 +01:00
list_controller.rb SECURITY: Harden ListController top period query against SQL injection [backport 2026.1] (#41723) 2026-07-15 12:18:25 +08:00
metadata_controller.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
new_invite_controller.rb FEATURE: Add invite link to the sidebar (#29448) 2024-10-30 05:31:14 +03:00
new_topic_controller.rb
notifications_controller.rb FIX: Hide badge notifications for disabled badges or when badges are disabled (#36987) 2026-01-07 15:28:43 +08:00
offline_controller.rb FEATURE: User fields required for existing users - Part 2 (#27172) 2024-06-25 19:32:18 +08:00
onebox_controller.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
pageview_controller.rb FEATURE: User fields required for existing users - Part 2 (#27172) 2024-06-25 19:32:18 +08:00
permalinks_controller.rb SECURITY: prevent permalink redirects from leaking restricted slugs 2026-01-28 17:11:14 +00:00
post_action_users_controller.rb SECURITY: hide total_rows for restricted post action types 2026-03-19 15:46:24 +00:00
post_actions_controller.rb SECURITY: fix is_warning type coercion bypass in PostActionsController 2026-03-19 15:46:24 +00:00
post_localizations_controller.rb FIX: Also check if user can see post or topic prior to letting them localize it (#36749) 2025-12-18 02:12:58 +08:00
post_readers_controller.rb SECURITY: Missing post-level authorization allows whisper metadata disclosure [backport 2026.1] 2026-03-31 15:12:50 +01:00
posts_controller.rb SECURITY: PostsController#raw_email leaks raw emails of inaccessible to mods [backport 2026.1] (#41966) 2026-07-23 16:37:00 +10:00
presence_controller.rb FIX: improve "read only" modes (#33521) 2025-07-10 09:08:00 +02:00
published_pages_controller.rb FEATURE: User fields required for existing users - Part 2 (#27172) 2024-06-25 19:32:18 +08:00
push_notification_controller.rb
qunit_controller.rb DEV: Only load specific plugin bundles during qunit test (#33678) 2025-07-21 21:00:48 +01:00
reviewable_claimed_topics_controller.rb FIX: Only log unclaimed history when topic was claimed (#36949) 2026-01-06 14:52:55 +08:00
reviewable_notes_controller.rb SECURITY: scope reviewable notes to user-visible reviewables 2026-02-26 12:24:37 +00:00
reviewables_controller.rb SECURITY: XSS in review queue via highlightWatchedWords 2026-03-19 15:46:24 +00:00
robots_txt_controller.rb DEV: Update link to comment in robots.txt as 'allow' is allowed (#33227) 2025-06-18 13:30:26 +08:00
safe_mode_controller.rb FIX: Set X-Robots-Tag header to prevent indexing of /safe-mode (#32329) 2025-04-16 16:51:32 +10:00
search_controller.rb FIX: stop delegating AI search to filter (#36968) 2026-01-07 07:34:05 +11:00
session_controller.rb FIX: invites to private topic when using discourse connect (#35303) 2025-10-10 07:32:40 +02:00
sidebar_sections_controller.rb FIX: on edit, ensure community section remains at top of sidebar (#36597) 2025-12-10 12:26:35 -05:00
similar_topics_controller.rb
site_controller.rb SECURITY: Preload data only when rendering application layout 2025-02-04 13:32:30 -03:00
sitemap_controller.rb
slugs_controller.rb
static_controller.rb SECURITY: Validate sso_destination_url cookie to prevent open redirect [backport 2026.1] 2026-03-31 15:12:50 +01:00
steps_controller.rb UX: One step wizard (#36082) 2025-11-25 13:35:32 -05:00
stylesheets_controller.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
svg_sprite_controller.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
tag_groups_controller.rb FIX: Use the max_tag_search_results setting as the default limit for tag groups search (#33485) 2025-07-09 05:13:19 +03:00
tag_localizations_controller.rb FEATURE: Introduce tag localizations with API, without UI yet (#36754) 2025-12-18 18:25:58 +08:00
tag_param_limit.rb SECURITY: Reject too many tags during post creation [backport 2026.1] (#41400) 2026-07-03 14:54:15 +08:00
tags_controller.rb SECURITY: Enforce hidden tag visibility in fetch_tag [backport 2026.1] 2026-03-31 15:12:50 +01:00
test_requests_controller.rb DEV: Add a user agent to all HTTP requests that Discourse makes. (#31555) 2025-03-03 16:32:25 +11:00
theme_javascripts_controller.rb DEV: Manually fix Rails/UnusedRenderContent offenses (#34418) 2025-08-22 11:42:12 +02:00
topic_localizations_controller.rb UX: Use inline title editor instead of composer when editing translation (#36847) 2025-12-24 00:56:36 +08:00
topic_view_stats_controller.rb FEATURE: topic_view_stats table with daily fidelity (#27197) 2024-05-27 15:25:32 +10:00
topics_controller.rb SECURITY: detailed_404 Security Setting Bypassed [backport 2026.1] (#41587) 2026-07-09 11:27:42 -05:00
uploads_controller.rb SECURITY: Download allowlist for uploaded files 2026-01-28 17:11:14 +00:00
user_actions_controller.rb SECURITY: Enforce Guardian checks in UserActionsController#show 2026-03-19 15:46:24 +00:00
user_api_key_clients_controller.rb Add user api key client rate limit settings (#30402) 2024-12-30 11:10:48 -05:00
user_api_keys_controller.rb SECURITY: Validate auth_redirect in UserApiKeysController#new to prevent open redirect phishing 2026-03-19 15:46:24 +00:00
user_avatars_controller.rb SECURITY: Improve SVG sanitization [backport 2026.1] 2026-06-30 16:27:06 +02:00
user_badges_controller.rb SECURITY: Prevent badge lookup from exposing hidden profiles [backport 2026.1] (#41163) 2026-06-25 14:11:30 +08:00
user_status_controller.rb
users_controller.rb SECURITY: An unauthorized user can delete emails of other users including Admins [backport 2026.1] (#41930) 2026-07-22 12:17:40 -05:00
users_email_controller.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
webhooks_controller.rb SECURITY: Prevent any signed AWS SNS TopicARN from being accepted via webhooks [backport 2026.1] 2026-06-30 16:27:06 +02:00
wizard_controller.rb