Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-06 13:08:40 +08:00
Code Packages Activity Actions
discourse/plugins/discourse-solved/spec/requests
History
Exact
discourse-patch-triage[bot] 6405e8eae0
 SECURITY: /solution/by_user leaks whisper/hidden accepted-answer post [backport 2026.1] (#41492) 
Backport of #41479 to release/2026.1.

---

## Summary

Prevent the unauthorized disclosure of hidden or whisper posts through
the `/solution/by_user` endpoint. The patch ensures that only posts
visible to the current visitor are returned by applying post-level
visibility filters and guardian authorization checks during
serialization.

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/1400

Co-authored-by: discourse-patch-triage
<272280883+discourse-patch-triage[bot]@users.noreply.github.com>

Co-authored-by: Isaac Janzen <50783505+janzenisaac@users.noreply.github.com>
2026-07-07 10:42:46 -05:00
..
answer_controller_spec.rb SECURITY: add visibility check for solved endpoints 2026-03-19 15:46:24 +00:00
list_controller_spec.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
solved_topics_controller_spec.rb SECURITY: /solution/by_user leaks whisper/hidden accepted-answer post [backport 2026.1] (#41492) 2026-07-07 10:42:46 -05:00
topics_controller_spec.rb