Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-06 13:08:40 +08:00
Code Packages Activity Actions
discourse/app/services
History
Exact
discoursebot 23bdf21a35
 SECURITY: Stale featured rows expose unlisted topic content [backport 2026.1] (#41813) 
Backport of #41810 to release/2026.1.

---

## Summary

Prevent the exposure of unlisted topic metadata in the categories
response by enforcing live visibility checks on featured topics.
Additionally, the UserSilencer service now correctly removes featured
topic records when bulk-hiding topics from new users, ensuring stale
records do not bypass visibility constraints.

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/1427

Co-authored-by: discourse-patch-triage
<272280883+discourse-patch-triage[bot]@users.noreply.github.com>

Co-authored-by: Bannon Tanner <bannon@discourse.org>
2026-07-17 09:40:52 -05:00
..
admin_notices FIX: Dismissing admin notices fails with 422 when tracker has NULL target (#36878) 2025-12-29 16:32:12 +01:00
discourse_id DEV: Allow new instances to be set up directly with Discourse ID (#36731) 2025-12-23 12:13:36 -05:00
flags FEATURE: allow edit custom flags (#32344) 2025-04-17 12:31:52 +08:00
notification/action FEATURE: Notify admins of upcoming changes and log events (#37003) 2026-01-21 12:45:54 +10:00
notifications FEATURE: Consolidate link notifications (#26567) 2024-04-09 11:53:37 -06:00
problem_check SECURITY: Prevent any signed AWS SNS TopicARN from being accepted via webhooks [backport 2026.1] 2026-06-30 16:27:06 +02:00
review DEV: Log Reviewable actions (#36076) 2025-11-20 13:41:40 +11:00
site_setting FEATURE: log admin's choice to backfill when updating a default site (#36296) 2025-11-27 18:40:07 +01:00
spam_rule FIX: Moderator notifications when new post auto-silences a user (#35403) 2025-10-15 16:07:56 +08:00
tags I18N: Add pluralization for chat rewind, bulk tagging & post deleted msg (#37255) 2026-01-26 14:41:54 +01:00
themes FIX: Add delete button to themes grid (#34606) 2025-08-29 10:09:23 +08:00
upcoming_changes FEATURE: Notify admins of upcoming changes and log events (#37003) 2026-01-21 12:45:54 +10:00
user SECURITY: Enforce edit permissions and audit trail in TriggerPostAction 2026-03-19 15:46:24 +00:00
video_conversion DEV: Add video conversion support for chat messages (#36275) 2025-12-01 12:34:56 -07:00
anonymous_shadow_creator.rb UX: Improve naming for anonymous mode settings (#31832) 2025-03-21 04:54:06 +03:00
badge_granter.rb FIX: Allow badges with SQL queries to be manually granted (#36866) 2026-01-09 13:58:09 +01:00
base_bookmarkable.rb SECURITY: Ensure guardian check when creating QueryGroupBookmark 2026-02-26 12:24:37 +00:00
category_hashtag_data_source.rb FEATURE: add icons and emojis to category (#31795) 2025-03-26 09:46:17 +04:00
category_hierarchical_search.rb FIX: Load categories for edit navigation menu modal in hierarchical order (#36927) 2026-01-07 14:03:52 +08:00
color_scheme_revisor.rb FEATURE: Allow editing theme-owned palettes (#34722) 2025-10-06 09:02:39 +03:00
destroy_task.rb FIX: Confirmation prompt breaks when using pipe (#35261) 2025-10-08 11:12:09 +08:00
email_settings_exception_handler.rb DEV: Remove IMAP support in Discourse (#37002) 2026-01-12 10:07:26 +10:00
email_settings_validator.rb DEV: Remove IMAP support in Discourse (#37002) 2026-01-12 10:07:26 +10:00
email_style_updater.rb
external_upload_manager.rb SECURITY: Regular users can route multipart uploads into the admin backup store [backport 2026.1] 2026-06-30 16:27:06 +02:00
group_action_logger.rb
group_mentions_updater.rb
group_message.rb DEV: Don't allow context-free system post destruction (#32523) 2025-05-05 09:58:29 +08:00
handle_chunk_upload.rb
hashtag_autocomplete_service.rb FEATURE: add icons and emojis to category (#31795) 2025-03-26 09:46:17 +04:00
heat_settings_updater.rb
inline_uploads.rb FIX: Use filename as alt for hotlinked image uploads (#31651) 2025-03-11 14:45:06 +11:00
locale_normalizer.rb FIX: Show localization for regionless locale if they exist (#33702) 2025-07-21 15:45:14 +08:00
notification_emailer.rb DEV: Bump rubocop_discourse (#29608) 2024-11-06 06:27:49 +08:00
post_action_notifier.rb
post_alerter.rb DEV: Remove IMAP support in Discourse (#37002) 2026-01-12 10:07:26 +10:00
post_bookmarkable.rb FIX: Serialize categories for bookmarks (#26606) 2024-04-17 17:23:47 +03:00
post_owner_changer.rb SECURITY: Ensure moderator can see post/topic before allowing them to change owner 2026-01-28 17:11:14 +00:00
push_notification_pusher.rb FIX: avoid double base path on push notification (#32228) 2025-04-12 08:16:53 +10:00
random_topic_selector.rb DEV: Remove Discourse.redis.delete_prefixed (#22103) 2023-06-16 12:44:35 +10:00
registered_bookmarkable.rb FIX: Bookmarkable query placholders (#35935) 2025-11-10 12:36:53 +10:00
search_indexer.rb FEATURE: Add full-text search for chat messages (#34704) 2025-10-22 11:30:35 +02:00
sidebar_section_links_updater.rb DEV: Limit the number of category sidebar links a user can have (#26756) 2024-04-25 13:21:39 -05:00
sidebar_site_settings_backfiller.rb DEV: Drop distributed mutex fromSidebarSiteSettingsBackfiller#backfill! (#25674) 2024-02-15 06:21:03 +08:00
site_setting_update_existing_users.rb FEATURE: Convert watched_precedence_over_muted to default site setting (#35671) 2025-10-30 10:04:18 +10:00
site_settings_task.rb FEATURE: mandatory fields for group site setting (#26612) 2024-04-18 08:53:52 +10:00
staff_action_logger.rb SECURITY: Restrict staff action logs visibility for moderators 2026-01-28 17:11:14 +00:00
tag_hashtag_data_source.rb DEV: add tag hashtag data source style type (#33289) 2025-06-20 18:08:47 +04:00
theme_settings_migrations_runner.rb DEV: Prepare for rename of app/assets/javascripts/ -> frontend/ 2025-10-22 16:24:11 +01:00
themes_install_task.rb FEATURE: Theme settings migrations (#24071) 2023-11-02 08:10:15 +03:00
topic_bookmarkable.rb FIX: Serialize categories for bookmarks (#26606) 2024-04-17 17:23:47 +03:00
topic_status_updater.rb FIX: Exclude unlisted topics from hot scores (#37312) 2026-01-27 13:46:57 +11:00
topic_timestamp_changer.rb
tracked_topics_updater.rb
trust_level_granter.rb
user_action_manager.rb FIX: permanent delete of posts by deleted users (#28992) 2024-09-24 12:26:31 +03:00
user_activator.rb DEV: Move more data into the server session (#35145) 2025-10-03 10:20:32 +02:00
user_anonymizer.rb FIX: Clean up historical staff logs when anonymizing users (#36936) 2026-01-14 14:53:38 +01:00
user_authenticator.rb DEV: Move more data into the server session (#35145) 2025-10-03 10:20:32 +02:00
user_destroyer.rb FIX: UserDestroyer should unclaim any claimed reviewables. (#36277) 2025-11-27 13:54:48 +11:00
user_merger.rb FIX: blocks post action merge for duplicated flags (#36265) 2025-11-26 16:17:57 -03:00
user_notification_renderer.rb
user_notification_schedule_processor.rb
user_password_expirer.rb DEV: Migrate user passwords data to UserPassword table (#28746) 2024-10-10 09:23:06 +08:00
user_silencer.rb SECURITY: Stale featured rows expose unlisted topic content [backport 2026.1] (#41813) 2026-07-17 09:40:52 -05:00
user_stat_count_updater.rb
user_suspender.rb SECURITY: Don't allow suspending staff users via other_user_ids param 2024-07-03 20:49:29 +08:00
user_updater.rb FEATURE: disable link notification user preference (#35352) 2025-10-14 10:53:05 +02:00
username_changer.rb
username_checker_service.rb
web_hook_emitter.rb DEV: Move webhook event header modifier for redelivery-recalucation (#27177) 2024-05-24 10:37:10 -05:00
wildcard_domain_checker.rb
wildcard_url_checker.rb
word_watcher.rb FIX: silent failure when watched words contains invalid regex (#36132) 2025-11-25 21:56:33 +01:00