Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-12 03:37:13 +08:00
Code Packages Activity Actions
discourse/app/models
History
Exact
discoursebot 23bdf21a35
 SECURITY: Stale featured rows expose unlisted topic content [backport 2026.1] (#41813) 
Backport of #41810 to release/2026.1.

---

## Summary

Prevent the exposure of unlisted topic metadata in the categories
response by enforcing live visibility checks on featured topics.
Additionally, the UserSilencer service now correctly removes featured
topic records when bulk-hiding topics from new users, ensuring stale
records do not bypass visibility constraints.

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/1427

Co-authored-by: discourse-patch-triage
<272280883+discourse-patch-triage[bot]@users.noreply.github.com>

Co-authored-by: Bannon Tanner <bannon@discourse.org>
2026-07-17 09:40:52 -05:00
..
concerns SECURITY: Signup-time primary_group_id assignment grants whisperer access [backport 2026.1] 2026-06-30 16:27:06 +02:00
about.rb DEV: Separate admins and moderators on about page (#31272) 2025-02-12 09:57:53 +08:00
admin_dashboard_data.rb DEV: Remove old problem check system - part 2 (#34403) 2025-08-20 16:15:21 +08:00
admin_dashboard_general_data.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
admin_dashboard_index_data.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
admin_notice.rb DEV: Database backed admin notices (#26192) 2024-05-23 09:29:08 +08:00
allowed_pm_user.rb FEATURE: Allow List for PMs (#10270) 2020-07-20 15:23:49 -06:00
anonymous_user.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
api_key.rb FIX: Preserve padding parameter through user API key authorization flow (#36640) 2025-12-12 13:56:21 +01:00
api_key_scope.rb FEATURE: Add granular API scope for changing post ownership (#36835) 2025-12-23 10:09:29 +01:00
application_request.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
associated_group.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
auto_track_duration_site_setting.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
backup_draft_post.rb FEATURE: experimental hidden setting for draft backups 2019-10-17 16:58:21 +11:00
backup_draft_topic.rb FEATURE: experimental hidden setting for draft backups 2019-10-17 16:58:21 +11:00
backup_file.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
backup_location_site_setting.rb DEV: Remove logical OR assignment of constants (#29201) 2024-10-16 10:09:07 +08:00
backup_metadata.rb DEV: Replace #pluck_first freedom patch with AR #pick in core (#19893) 2023-02-13 12:39:45 +08:00
badge.rb FIX: Allow badges with SQL queries to be manually granted (#36866) 2026-01-09 13:58:09 +01:00
badge_grouping.rb DEV: Set limits for text fields on BadgeGrouping 2023-05-15 09:54:54 +02:00
badge_type.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
base_font_setting.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
base_timer.rb DEV: rename topic_id to timerable_id for BaseTimer (#34667) 2025-09-17 13:19:17 +08:00
bookmark.rb DEV: Hand-pick Rails/WhereNot autofixes (#35117) 2025-10-03 13:29:22 +02:00
category.rb SECURITY: Harden ListController top period query against SQL injection [backport 2026.1] (#41723) 2026-07-15 12:18:25 +08:00
category_and_topic_lists.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
category_custom_field.rb DEV: Add true_fields method for CustomFields (#24876) 2023-12-14 11:06:21 -06:00
category_featured_topic.rb DEV: Prefer nested queries (#23464) 2023-09-25 19:38:54 +03:00
category_form_template.rb DEV: Apply form template to categories (#20337) 2023-02-23 11:18:14 -08:00
category_group.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
category_list.rb SECURITY: Stale featured rows expose unlisted topic content [backport 2026.1] (#41813) 2026-07-17 09:40:52 -05:00
category_localization.rb DEV: Use localizable concerns across post, topic, categories (#34137) 2025-08-07 22:12:01 +08:00
category_moderation_group.rb FEATURE: Support designating multiple groups as mods on category (#28655) 2024-09-04 04:38:46 +03:00
category_page_style.rb FEATURE: Paginate categories when there are many (#29569) 2024-11-11 17:32:45 +02:00
category_required_tag_group.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
category_search_data.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
category_setting.rb DEV: Switch over category settings to new table - Part 3 (#20657) 2023-09-12 09:51:49 +08:00
category_tag.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
category_tag_group.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
category_tag_stat.rb FIX: Update category tag stats with new or deleted (#21531) 2023-05-18 12:46:44 +03:00
category_user.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
child_theme.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
color_scheme.rb FEATURE: Allow editing theme-owned palettes (#34722) 2025-10-06 09:02:39 +03:00
color_scheme_color.rb FEATURE: Allow editing theme-owned palettes (#34722) 2025-10-06 09:02:39 +03:00
color_scheme_setting.rb DEV: Remove dual mode support for palettes and drop theme-owned palettes (#34467) 2025-08-26 06:24:11 +03:00
composition_mode_site_setting.rb FEATURE: Enable rich editor for all users (#33699) 2025-07-28 10:08:50 +10:00
custom_emoji.rb FEATURE: Add creator and logging for CustomEmoji (#28004) 2024-07-22 14:44:49 +08:00
default_text_size_setting.rb FEATURE: fonts section for branding page (#32031) 2025-04-07 10:28:42 +08:00
developer.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
digest_email_site_setting.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
directory_column.rb DEV: Remove ignored columns that are now dropped in migration (#36129) 2025-11-20 11:09:58 +08:00
directory_item.rb PERF: DirectoryItem.refresh! daily can take an extremely long time (#35860) 2025-11-10 13:23:23 +10:00
discourse_connect.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
discourse_version_check.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
dismissed_topic_user.rb FEATURE: New way to dismiss new topics (#11927) 2021-02-04 11:27:34 +11:00
do_not_disturb_timing.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
draft.rb FIX: certain edge cases could leave phantom drafts behind (#37130) 2026-01-16 13:17:18 +11:00
draft_sequence.rb FIX: certain edge cases could leave phantom drafts behind (#37130) 2026-01-16 13:17:18 +11:00
email_change_request.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
email_level_site_setting.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
email_log.rb DEV: Remove logical OR assignment of constants (#29201) 2024-10-16 10:09:07 +08:00
email_style.rb DEV: Fix Lint/DuplicateMethods (#24746) 2023-12-06 13:18:34 +01:00
email_token.rb DEV: Remove ignored columns that are now dropped in migration (#36129) 2025-11-20 11:09:58 +08:00
embeddable_host.rb DEV: Remove ignored columns that are now dropped in migration (#36129) 2025-11-20 11:09:58 +08:00
embeddable_host_tag.rb FEATURE: Extend embeddable hosts with Individual tags and author assignments (#26868) 2024-05-16 15:47:01 -04:00
embedding.rb DEV: Deprecate the assignment of nil to site settings (#36093) 2025-12-01 15:04:23 +08:00
emoji.rb FIX: Emoji.exists? should be consistent with Emoji[] (#36347) 2025-12-01 18:58:30 +01:00
emoji_set_site_setting.rb DEV: discourse-emojis gem (#31408) 2025-03-03 13:09:08 +01:00
external_upload_stub.rb DEV: Improve external upload debugging (#28627) 2024-08-30 10:25:04 +10:00
flag.rb PERF: Avoid slow preloading in SiteSerializer (#33283) 2025-06-25 15:03:34 +08:00
form_template.rb FIX: Process templates before previewing (#33848) 2025-07-29 15:09:02 +08:00
full_name_requirement.rb FEATURE: Add option to hide full name input at signup (#30471) 2024-12-30 22:26:20 +03:00
given_daily_like.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
global_setting.rb FIX: various SMTP timeouts should be used as floats 2025-12-16 09:35:01 -05:00
group.rb DEV: Remove IMAP support in Discourse (#37002) 2026-01-12 10:07:26 +10:00
group_archived_message.rb DEV: Remove IMAP support in Discourse (#37002) 2026-01-12 10:07:26 +10:00
group_associated_group.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
group_category_notification_default.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
group_custom_field.rb DEV: Add true_fields method for CustomFields (#24876) 2023-12-14 11:06:21 -06:00
group_history.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
group_mention.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
group_request.rb DEV: Bump the limits on group request text fields 2023-05-24 09:57:46 +02:00
group_tag_notification_default.rb FIX: Error when moving the group default notification state (#28910) 2024-09-13 16:01:20 -03:00
group_user.rb FIX: Skip trust level changes when group grant_trust_level is 0 (#35572) 2025-10-23 14:23:25 -04:00
ignored_user.rb DEV: Update core model annotations 2021-07-06 10:11:06 +01:00
image_quality_setting.rb FEATURE: Add new, unified image_quality site setting (#35467) 2025-10-29 13:17:28 +08:00
incoming_domain.rb DEV: Update to lastest rubocop-discourse 2024-05-27 18:06:14 +02:00
incoming_email.rb DEV: Remove IMAP support in Discourse (#37002) 2026-01-12 10:07:26 +10:00
incoming_link.rb PERF: Add indexes to improve user merger performance (#33271) 2025-07-10 18:18:40 -03:00
incoming_links_report.rb FIX: Respect date range in top traffic sources report (#25599) 2024-02-08 11:17:59 -05:00
incoming_referer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
interface_color_selector_setting.rb FEATURE: Dark/light mode selector (#31086) 2025-02-07 03:28:34 +03:00
invite.rb DEV: Remove ignored columns that are now dropped in migration (#36129) 2025-11-20 11:09:58 +08:00
invite_redeemer.rb DEV: Update to lastest rubocop-discourse 2024-05-27 18:06:14 +02:00
invited_group.rb FEATURE: Various improvements to invite system (#12314) 2021-03-09 00:15:14 +02:00
invited_user.rb FIX: reduce redemption_count when invited user is destroyed (#35695) 2025-10-30 13:43:51 +11:00
javascript_cache.rb DEV: Upgrade Rails to version 8.0.2 2025-07-22 09:59:44 +02:00
like_notification_frequency_site_setting.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
linked_topic.rb FEATURE: new setting to create a linked topic on autoclosing mega topics (#11001) 2020-11-02 12:18:48 +05:30
locale_site_setting.rb FEATURE: Localize language names (#33790) 2025-07-29 11:48:45 +08:00
mailing_list_mode_site_setting.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
mobile_category_page_style.rb FEATURE: add new setting to select view for category page on mobile (#30519) 2025-01-06 09:25:25 +05:30
moved_post.rb DEV: add full_move to MovedPost record small_action modifier (#30236) 2024-12-12 11:47:14 -06:00
muted_user.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
navigation_menu_site_setting.rb FEATURE: Remove support for legacy navigation menu (#23752) 2023-10-09 07:24:10 +08:00
new_topic_duration_site_setting.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
notification.rb FEATURE: Notify admins of upcoming changes and log events (#37003) 2026-01-21 12:45:54 +10:00
notification_level_when_replying_site_setting.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
oauth2_user_info.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
onceoff_log.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
onebox_locale_site_setting.rb FEATURE: Add a onebox_locale site setting. (#30655) 2025-01-09 14:11:37 +11:00
optimized_image.rb FEATURE: Add new, unified image_quality site setting (#35467) 2025-10-29 13:17:28 +08:00
optimized_video.rb DEV: Ensure optimized videos have the correct acl (#36364) 2025-12-01 19:50:08 -07:00
permalink.rb SECURITY: prevent permalink redirects from leaking restricted slugs 2026-01-28 17:11:14 +00:00
plugin_store.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
plugin_store_row.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
post.rb SECURITY: fix loose hostname matching in spam host allowlist 2026-03-19 15:46:24 +00:00
post_action.rb PERF: Add indexes to improve user merger performance (#33271) 2025-07-10 18:18:40 -03:00
post_action_type.rb FIX: flaky flags system spec (#29039) 2024-10-08 08:38:42 +11:00
post_analyzer.rb DEV: Update to lastest rubocop-discourse 2024-05-27 18:06:14 +02:00
post_custom_field.rb DEV: Upgrade Rails to version 8.0.2 2025-07-22 09:59:44 +02:00
post_detail.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
post_hotlinked_media.rb DEV: Upgrade Rails to version 7.2 2024-11-27 10:48:47 +01:00
post_localization.rb FEATURE: Add support for uploads on translated posts (#35871) 2025-11-12 08:55:21 -08:00
post_mover.rb FIX: Avoid reload side effects in PostDestroyer#recover (#36983) 2026-01-19 17:14:42 +01:00
post_reply.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
post_reply_key.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
post_revision.rb DEV: Upgrade Rails to version 8.0.2 2025-07-22 09:59:44 +02:00
post_search_data.rb DEV: annotate models (#11047) 2020-10-27 23:42:33 +05:30
post_stat.rb FEATURE: Store composer version and device info on post stat (#31600) 2025-03-05 12:48:32 +10:00
post_stripper.rb FIX: user got notified about a mention inside a chat message quote (#24229) 2023-11-08 23:13:25 +04:00
post_timing.rb FIX: update PM tracking state when marking messages as unread (#36258) 2025-11-26 18:29:35 +01:00
previous_replies_site_setting.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
private_message_topic_tracking_state.rb PERF: avoid publishing user actions to the user who did the action (#26225) 2024-03-18 18:05:46 +01:00
problem_check.rb SECURITY: Prevent any signed AWS SNS TopicARN from being accepted via webhooks [backport 2026.1] 2026-06-30 16:27:06 +02:00
problem_check_tracker.rb FIX: Dismissing admin notices fails with 422 when tracker has NULL target (#36878) 2025-12-29 16:32:12 +01:00
published_page.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
push_subscription.rb DEV: Update core model annotations 2021-07-06 10:11:06 +01:00
quoted_post.rb DEV: Replace #pluck_first freedom patch with AR #pick in core (#19893) 2023-02-13 12:39:45 +08:00
redelivering_webhook_event.rb FEATURE: Add Mechanism to redeliver all failed webhook events (#27609) 2024-07-08 15:43:16 -05:00
remote_theme.rb FIX: Prevent deletion of custom color palettes when installing themes (#35754) 2025-11-03 14:09:46 +08:00
remove_muted_tags_from_latest_site_setting.rb DEV: Remove logical OR assignment of constants (#29201) 2024-10-16 10:09:07 +08:00
report.rb SECURITY: Do not leak PM post edits to moderators 2026-03-19 15:46:24 +00:00
reviewable.rb FIX: keeps force_review once set to true (#38795) (#38986) 2026-03-30 15:54:28 -03:00
reviewable_action_log.rb DEV: Log Reviewable actions (#36076) 2025-11-20 13:41:40 +11:00
reviewable_claimed_topic.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
reviewable_flagged_post.rb FIX: Include user in /reviewable_claimed message (#37190) 2026-01-19 14:46:40 +08:00
reviewable_history.rb DEV: Upgrade Rails to version 7.2 2024-11-27 10:48:47 +01:00
reviewable_note.rb DEV: Add a ReviewableNote model, and tie it into the Reviewable model. (#33047) 2025-06-04 09:33:02 +10:00
reviewable_post.rb UX: refactor review queue buttons for more consistent language (#36812) 2026-01-13 10:17:29 -05:00
reviewable_priority_setting.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
reviewable_queued_post.rb UX: refactor review queue buttons for more consistent language (#36812) 2026-01-13 10:17:29 -05:00
reviewable_score.rb PERF: Avoid slow preloading in SiteSerializer (#33283) 2025-06-25 15:03:34 +08:00
reviewable_sensitivity_setting.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
reviewable_user.rb UX: refactor review queue buttons for more consistent language (#36812) 2026-01-13 10:17:29 -05:00
s3_region_site_setting.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
screened_email.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
screened_ip_address.rb DEV: Update to lastest rubocop-discourse 2024-05-27 18:06:14 +02:00
screened_url.rb DEV: Prefer \A and \z over ^ and $ in regexes (#19936) 2023-01-20 12:52:49 -06:00
search_experience_site_setting.rb FEATURE: add search field to header (#31447) 2025-02-28 12:47:09 +04:00
search_log.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
search_sort_order_site_setting.rb FEATURE: Add setting & preference for search sort default order (#24428) 2023-11-20 10:43:58 +10:00
shared_draft.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
shelved_notification.rb DEV: Promote historic post_deploy migrations (#34273) 2025-08-13 14:10:50 +08:00
sidebar_section.rb DEV: Limit the number of category sidebar links a user can have (#26756) 2024-04-25 13:21:39 -05:00
sidebar_section_link.rb FIX: public sidebar sections belong to system user (#20972) 2023-04-05 10:52:18 +10:00
sidebar_url.rb FEATURE: dynamic search when in /filter route (#33614) 2025-07-22 16:08:10 +10:00
single_sign_on_record.rb DEV: Increases external avatar url limit (#28893) 2024-09-13 01:08:01 +02:00
site.rb FIX: Don’t apply callbacks from disabled plugins (#35630) 2025-10-30 10:04:17 +01:00
site_setting.rb FIX: Also automatically translate to site's default locale (#37292) 2026-01-24 00:08:34 +08:00
site_setting_group.rb FEATURE: Upcoming changes part 1 (#34617) 2025-10-30 10:46:14 +10:00
sitemap.rb FIX: Ensure sitemaps include all topics with no duplicates (#26289) 2024-03-21 13:19:53 +00:00
skipped_email_log.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
slug_setting.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
stat.rb FEATURE: Enable the new /about page for everyone (#29390) 2024-10-29 18:40:11 +03:00
stylesheet_cache.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
tag.rb DEV: Add slugs to tag model (#36985) 2026-01-08 11:03:01 +08:00
tag_group.rb FEATURE: allow filtering of tag groups with special chars (#37049) 2026-01-13 11:53:08 +11:00
tag_group_membership.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
tag_group_permission.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
tag_localization.rb SECURITY: Unsanitized TagLocalization Descriptions [backport 2026.1] (#41562) 2026-07-15 08:49:44 -05:00
tag_search_data.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
tag_user.rb DEV: Ensure unique notification level per tag user (#28638) 2024-09-03 15:43:02 +08:00
theme.rb DEV: Refactor locale bundle loading (#37114) 2026-01-16 11:45:14 +00:00
theme_field.rb DEV: Refactor locale bundle loading (#37114) 2026-01-16 11:45:14 +00:00
theme_modifier_set.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
theme_setting.rb DEV: Fix schema settings upload cleanup (#37063) 2026-01-12 12:23:05 -06:00
theme_settings_migration.rb DEV: Introduce run_theme_migration spec helper in test environment (#26845) 2024-05-03 06:29:18 +08:00
theme_site_setting.rb DEV: Refactor and add missing tests for upload type in objects schema (#36285) 2025-11-28 04:02:23 +08:00
theme_svg_sprite.rb FIX: Always clear caches after committing the current transaction (#22550) 2023-07-12 09:49:28 -05:00
theme_translation_override.rb DEV: Use the theme cache helper for settings 2022-02-21 09:45:14 +00:00
top_lists.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
top_menu_item.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
top_topic.rb PERF: Drop unused indexes on top_topics table (#37053) 2026-01-12 12:55:28 +08:00
topic.rb SECURITY: Normalize and escape topic featured links [backport 2026.1] 2026-06-30 16:27:06 +02:00
topic_allowed_group.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
topic_allowed_user.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
topic_converter.rb FIX: display validation errors when converting topics (#27064) 2024-05-17 16:36:25 +02:00
topic_custom_field.rb DEV: Upgrade Rails to version 8.0.2 2025-07-22 09:59:44 +02:00
topic_embed.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
topic_featured_users.rb DEV: Optimize core user merger (#36455) 2025-12-05 14:45:54 -03:00
topic_group.rb DEV: Enable unless cops 2023-02-21 10:30:48 +01:00
topic_hot_score.rb FIX: Exclude unlisted topics from hot scores (#37312) 2026-01-27 13:46:57 +11:00
topic_invite.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
topic_link.rb SECURITY: Whisper metadata disclosure via stale TopicLinks [backport 2026.1] (#41145) 2026-06-24 15:51:51 +10:00
topic_link_click.rb SECURITY: Missing visibility check in click tracking endpoint [backport 2026.1] (#41148) 2026-06-24 15:47:50 +10:00
topic_list.rb FIX: Inconsistent op_like_count serialization with serialize_topic_op_likes_data (#36950) 2026-01-07 19:12:22 +01:00
topic_localization.rb DEV: Add rake task to backfill localization excerpts which were empty (#36901) 2025-12-30 17:04:36 +08:00
topic_notifier.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
topic_participant_groups_summary.rb FEATURE: display PM participant group names in the topics list. (#21677) 2023-05-31 19:32:06 +05:30
topic_participants_summary.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
topic_poster.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
topic_posters_summary.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
topic_search_data.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
topic_tag.rb FIX: Add extra tag_id, topic_id index to topic_tags (#35565) 2025-10-23 17:34:16 +10:00
topic_thumbnail.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
topic_timer.rb DEV: rename topic_id to timerable_id for BaseTimer (#34667) 2025-09-17 13:19:17 +08:00
topic_tracking_state.rb DEV: Add topic_tracking_state_publish_unread_scope modifier (#37236) 2026-01-21 17:59:33 +08:00
topic_user.rb DEV: Remove ignored columns that are now dropped in migration (#36129) 2025-11-20 11:09:58 +08:00
topic_view_item.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
topic_view_stat.rb FEATURE: topic_view_stats table with daily fidelity (#27197) 2024-05-27 15:25:32 +10:00
translation_override.rb UX: Enable site_name for all header fields on welcome banner (#37186) 2026-01-20 17:35:48 +00:00
trust_level3_requirements.rb DEV: Hand-pick Rails/WhereNot autofixes (#35117) 2025-10-03 13:29:22 +02:00
trust_level_and_staff_and_disabled_setting.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
trust_level_and_staff_setting.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
trust_level_setting.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
unsubscribe_key.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
upcoming_change_event.rb FEATURE: Notify admins of upcoming changes and log events (#37003) 2026-01-21 12:45:54 +10:00
upload.rb SECURITY: Harden imagemagick execution [backport 2026.1] 2026-06-30 16:27:06 +02:00
upload_reference.rb Revert "FIX: Post uploads setting access_control_post_id unnecessarily (#26627)" (#26643) 2024-04-16 14:10:25 +10:00
user.rb FIX: Move quoted post rebaking on avatar upload to a background job … (#40247) 2026-05-22 14:56:22 -03:00
user_action.rb SECURITY: Restrict user action removal messages [backport 2026.1] (#41412) 2026-07-03 18:25:40 +08:00
user_api_key.rb DEV: Remove ignored columns that are now dropped in migration (#36129) 2025-11-20 11:09:58 +08:00
user_api_key_client.rb Require permitted scopes when registering a client (#29718) 2024-11-19 15:28:04 -05:00
user_api_key_client_scope.rb Use lambda to dynamically evaluate allowed user api key client scopes (#30544) 2025-01-03 10:25:21 -05:00
user_api_key_scope.rb DEV: Allow user api key scope for notifications#totals (#26205) 2024-03-15 16:06:32 -04:00
user_archived_message.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
user_associated_account.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
user_associated_group.rb FIX: Do not remove user from group with no association inadvertently [backport 2026.1] (#39925) 2026-05-12 16:48:56 +01:00
user_auth_token.rb SECURITY: Bind shared session key to auth token and enforce user gates [backport 2026.1] (#41691) 2026-07-14 15:48:25 +08:00
user_auth_token_log.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
user_avatar.rb DEV: ensure rebaking works even when some users have inconsistent data (#30261) 2024-12-16 19:48:25 +08:00
user_badge.rb DEV: Promote historic post_deploy migrations (#34273) 2025-08-13 14:10:50 +08:00
user_badges.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
user_bookmark_list.rb FIX: Serialize categories for bookmarks (#26606) 2024-04-17 17:23:47 +03:00
user_custom_field.rb DEV: Upgrade Rails to version 8.0.2 2025-07-22 09:59:44 +02:00
user_email.rb FIX: allow users with normalized emails to change emails and remove + / . (#37133) 2026-01-16 07:36:58 +11:00
user_export.rb FEATURE: Allow admins to export users (#30918) 2025-01-24 08:13:25 +11:00
user_field.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
user_field_option.rb FIX: Validate value of custom dropdown user fields - dropdowns and multiple selects (#13890) 2021-07-30 13:50:47 -04:00
user_history.rb SECURITY: Restrict staff action logs visibility for moderators 2026-01-28 17:11:14 +00:00
user_ip_address_history.rb DEV: annotate models (#11047) 2020-10-27 23:42:33 +05:30
user_notification_schedule.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
user_open_id.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
user_option.rb FEATURE: Convert watched_precedence_over_muted to default site setting (#35671) 2025-10-30 10:04:18 +10:00
user_password.rb FIX: setting new password should reset password_expired_at (#29296) 2024-10-21 07:24:43 +08:00
user_profile.rb DEV: Remove ignored columns that are now dropped in migration (#36129) 2025-11-20 11:09:58 +08:00
user_profile_view.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
user_required_fields_version.rb FEATURE: User fields required for existing users - Part 2 (#27172) 2024-06-25 19:32:18 +08:00
user_search.rb FEATURE: add claimed by filter to review queue, make assigned more distinct (#36090) 2025-11-24 16:27:41 -05:00
user_search_data.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
user_second_factor.rb SECURITY: Limit name field length of TOTP authenticators and security keys 2023-09-12 15:31:17 -03:00
user_security_key.rb Added button to remove password from account (#32200) 2025-04-09 09:32:51 -05:00
user_stat.rb DEV: Remove ignored columns that are now dropped in migration (#36129) 2025-11-20 11:09:58 +08:00
user_status.rb FIX: Truncate existing user status to 100 chars (#20044) 2023-01-30 10:49:08 +02:00
user_summary.rb FIX: Respect permissions when counting bookmarks in user summary (#36856) 2026-01-21 16:34:55 +01:00
user_upload.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
user_visit.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
user_warning.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
username_validator.rb FEATURE: Add plugin hook for extra username validations (#35522) 2025-10-27 11:03:42 -03:00
watched_word.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
watched_word_group.rb SECURITY: limit the number of characters in watched word replacements. 2024-07-15 19:25:17 +08:00
web_crawler_request.rb DEV: Replace #pluck_first freedom patch with AR #pick in core (#19893) 2023-02-13 12:39:45 +08:00
web_hook.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
web_hook_event.rb FIX: Make web_hook_events#id a bigint (#34620) 2025-09-04 22:20:34 +03:00
web_hook_event_type.rb Add user_anonymized webhook event (#36208) 2025-11-25 07:43:16 -08:00
web_hook_event_types_hook.rb FEATURE: granular webhooks (#23070) 2023-10-09 03:35:31 +00:00
web_hook_events_daily_aggregate.rb FIX: Division by zero error on WebHookEventsDailyAggregate (#27667) 2024-07-01 15:40:52 -03:00
welcome_banner_location.rb UX: add welcome banner location site setting to admin interface (#33438) 2025-07-17 13:34:22 +08:00
welcome_banner_page_visibility.rb UX: add welcome banner page visibility setting (#34119) 2025-08-08 14:19:00 +08:00