Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-06 13:08:40 +08:00
Code Packages Activity Actions
discourse/lib/guardian
History
Exact
discourse-patch-triage[bot] 6405e8eae0
 SECURITY: /solution/by_user leaks whisper/hidden accepted-answer post [backport 2026.1] (#41492) 
Backport of #41479 to release/2026.1.

---

## Summary

Prevent the unauthorized disclosure of hidden or whisper posts through
the `/solution/by_user` endpoint. The patch ensures that only posts
visible to the current visitor are returned by applying post-level
visibility filters and guardian authorization checks during
serialization.

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/1400

Co-authored-by: discourse-patch-triage
<272280883+discourse-patch-triage[bot]@users.noreply.github.com>

Co-authored-by: Isaac Janzen <50783505+janzenisaac@users.noreply.github.com>
2026-07-07 10:42:46 -05:00
..
bookmark_guardian.rb DEV: Consistently use Guardian helper methods (#34024) 2025-08-14 15:23:42 +08:00
category_guardian.rb FEATURE: Split setting for allowing mods to manage categories and groups (#35174) 2025-10-06 10:43:42 +03:00
ensure_magic.rb DEV: Prefer \A and \z over ^ and $ in regexes (#19936) 2023-01-20 12:52:49 -06:00
flag_guardian.rb FEATURE: allow edit custom flags (#32344) 2025-04-17 12:31:52 +08:00
group_guardian.rb FEATURE: Split setting for allowing mods to manage categories and groups (#35174) 2025-10-06 10:43:42 +03:00
invite_guardian.rb FIX: Allow admins to delete invites created by others (#34064) 2025-08-12 05:43:01 +03:00
localization_guardian.rb FEATURE: Introduce tag localizations with API, without UI yet (#36754) 2025-12-18 18:25:58 +08:00
permalink_guardian.rb SECURITY: prevent permalink redirects from leaking restricted slugs 2026-01-28 17:11:14 +00:00
post_guardian.rb SECURITY: /solution/by_user leaks whisper/hidden accepted-answer post [backport 2026.1] (#41492) 2026-07-07 10:42:46 -05:00
post_revision_guardian.rb
sidebar_guardian.rb DEV: specs to ensure that only admin can edit Community section (#21666) 2023-05-23 10:54:55 +10:00
staff_action_log_guardian.rb SECURITY: Restrict staff action logs visibility for moderators 2026-01-28 17:11:14 +00:00
tag_guardian.rb SECURITY: Prevent users from editing or synonymizing hidden tags they can't see 2026-03-19 15:46:24 +00:00
topic_guardian.rb SECURITY: Require topic visibility for category group moderator actions [backport 2026.1] 2026-05-19 00:26:55 +01:00
user_guardian.rb SECURITY: Moderators can no longer edit user's emails. 2026-01-28 17:11:14 +00:00