Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-08 17:53:55 +08:00
Code Packages Activity Actions
discourse/spec
History
Exact
discoursebot cedbe30abf
 SECURITY: PostsController#raw_email leaks raw emails of inaccessible to mods [backport 2026.1] (#41966) 
Backport of #41962 to release/2026.1.

---

## Summary

Prevent unauthorized access to raw emails by ensuring the mod has
permission to view the underlying post before granting access to its raw
email data. This addresses an issue where members of privileged groups
could bypass visibility restrictions to view raw email content for
private messages or deleted posts.

Co-authored-by: discourse-patch-triage
<272280883+discourse-patch-triage[bot]@users.noreply.github.com>

Co-authored-by: Sam <sam.saffron@gmail.com>
2026-07-23 16:37:00 +10:00
..
db/migrate DEV: Add slugs to tag model (#36985) 2026-01-08 11:03:01 +08:00
fabricators SECURITY: Add guardian check on PM to topic conversion 2026-01-28 17:11:14 +00:00
fixtures DEV: use minimally necessary encoding in html_reply.eml fixture 2026-01-15 13:05:25 -05:00
generator DEV: Remove deprecated trust level access settings (#36414) 2025-12-11 11:09:29 +10:00
helpers SECURITY: Bind shared session key to auth token and enforce user gates [backport 2026.1] (#41691) 2026-07-14 15:48:25 +08:00
import_export
initializers SECURITY: Harden imagemagick execution [backport 2026.1] 2026-06-30 16:27:06 +02:00
integration FIX: do not use public IP address space for tests 2025-12-16 09:35:01 -05:00
integrity PERF: Reject anonymous requests with 503 upon aggressive queuing (#36519) 2025-12-18 10:23:42 +08:00
jobs SECURITY: Authorize secure-upload hotlink downloads against post user [backport 2026.1] 2026-06-30 16:27:06 +02:00
lib SECURITY: Unsanitized TagLocalization Descriptions [backport 2026.1] (#41562) 2026-07-15 08:49:44 -05:00
mailers DEV: Remove IMAP support in Discourse (#37002) 2026-01-12 10:07:26 +10:00
models SECURITY: Harden ListController top period query against SQL injection [backport 2026.1] (#41723) 2026-07-15 12:18:25 +08:00
multisite FEATURE: Notify admins of upcoming changes and log events (#37003) 2026-01-21 12:45:54 +10:00
queries/reports FEATURE: Add admin-only reports and centralize report visibility logic 2026-01-28 17:11:14 +00:00
requests SECURITY: PostsController#raw_email leaks raw emails of inaccessible to mods [backport 2026.1] (#41966) 2026-07-23 16:37:00 +10:00
script/import_scripts
serializers SECURITY: /directory_items leaks restricted user-field values [backport 2026.1] (#41485) 2026-07-06 14:26:20 -05:00
services SECURITY: Stale featured rows expose unlisted topic content [backport 2026.1] (#41813) 2026-07-17 09:40:52 -05:00
support DEV: Remove IMAP support in Discourse (#37002) 2026-01-12 10:07:26 +10:00
system SECURITY: XSS in review queue via highlightWatchedWords 2026-03-19 15:46:24 +00:00
tasks DEV: Update stage_security_fixes rake task (#37346) 2026-01-28 15:12:29 +00:00
views FIX: remove ItemList schema from linkbacks in crawler view (#36608) 2025-12-11 10:41:47 +01:00
rails_helper.rb DEV: Use CDP to override browser timezone in system specs (#36880) 2025-12-29 09:23:17 +10:00
regenerate_swagger_docs
swagger_helper.rb DEV: add api docs for discourse-calendar events index endpoint (#35400) 2025-10-16 07:39:08 +08:00