Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-09 21:45:25 +08:00
Code Packages Activity Actions
discourse/spec/requests
History
Exact
discoursebot cedbe30abf
 SECURITY: PostsController#raw_email leaks raw emails of inaccessible to mods [backport 2026.1] (#41966) 
Backport of #41962 to release/2026.1.

---

## Summary

Prevent unauthorized access to raw emails by ensuring the mod has
permission to view the underlying post before granting access to its raw
email data. This addresses an issue where members of privileged groups
could bypass visibility restrictions to view raw email content for
private messages or deleted posts.

Co-authored-by: discourse-patch-triage
<272280883+discourse-patch-triage[bot]@users.noreply.github.com>

Co-authored-by: Sam <sam.saffron@gmail.com>
2026-07-23 16:37:00 +10:00
..
admin SECURITY: block cross-site backup traversal in multisite local storage [backport 2026.1] 2026-05-19 00:26:55 +01:00
api SECURITY: Respect group member visibility for counts [backport 2026.1] (#41420) 2026-07-06 12:47:49 +08:00
examples
about_controller_spec.rb
application_controller_spec.rb SECURITY: Bind shared session key to auth token and enforce user gates [backport 2026.1] (#41691) 2026-07-14 15:48:25 +08:00
associate_accounts_controller_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
badges_controller_spec.rb
bookmarks_controller_spec.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
categories_controller_spec.rb SECURITY: Stale featured rows expose unlisted topic content [backport 2026.1] (#41813) 2026-07-17 09:40:52 -05:00
clicks_controller_spec.rb SECURITY: Missing visibility check in click tracking endpoint [backport 2026.1] (#41148) 2026-06-24 15:47:50 +10:00
composer_controller_spec.rb SECURITY: Respect group member visibility for counts [backport 2026.1] (#41420) 2026-07-06 12:47:49 +08:00
composer_messages_controller_spec.rb SECURITY: Whisper metadata disclosure via stale TopicLinks [backport 2026.1] (#41145) 2026-06-24 15:51:51 +10:00
crawler_hreflang_spec.rb FEATURE: Append locale to links in crawler view if present (#34466) 2025-08-22 08:46:33 +08:00
csp_reports_controller_spec.rb DEV: Don’t replace Rails logger in specs (#29721) 2024-11-13 08:47:39 +08:00
default_headers_spec.rb DEV: Disallow the use of Rails.logger= in RSpec tests (#31920) 2025-03-21 08:48:38 +08:00
dev_mode_controller_spec.rb DEV: Add /dev-mode endpoint for MiniProfiler auth cookie (#37027) 2026-01-12 10:01:20 +08:00
directory_columns_controller_spec.rb
directory_items_controller_spec.rb SECURITY: Private UserField value disclosure via directory_items order sort side-channel [backport 2026.1] (#41601) 2026-07-09 21:53:32 -05:00
discourse_id_controller_spec.rb DEV: Add validator for enable_discourse_id setting (#33710) 2025-07-21 08:18:36 -04:00
do_not_disturb_controller_spec.rb
drafts_controller_spec.rb DEV: Better protection for drafts 2026-01-28 17:11:14 +00:00
edit_directory_columns_controller_spec.rb
email_controller_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
embed_controller_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
emojis_controller_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
exceptions_controller_spec.rb FIX: Respect forced color mode for logo on server-rendered pages (#37032) 2026-01-09 11:33:06 +01:00
export_csv_controller_spec.rb SECURITY: Prevent moderators from exporting admin-only reports via CSV [backport 2026.1] 2026-03-31 15:12:50 +01:00
extra_locales_controller_spec.rb DEV: Refactor locale bundle loading (#37114) 2026-01-16 11:45:14 +00:00
finish_installation_controller_spec.rb DEV: Allow new instances to be set up directly with Discourse ID (#36731) 2025-12-23 12:13:36 -05:00
form_templates_controller_spec.rb SECURITY: Scope form template endpoints to accessible categories [backport 2026.1] 2026-05-19 00:26:55 +01:00
forums_controller_spec.rb FIX: improve "read only" modes (#33521) 2025-07-10 09:08:00 +02:00
groups_controller_spec.rb SECURITY: mentionable/messageable endpoints bypassing visibility controls [backport 2026.1] (#41523) 2026-07-07 14:38:45 -05:00
hashtags_controller_spec.rb DEV: add tag hashtag data source style type (#33289) 2025-06-20 18:08:47 +04:00
highlightjs_controller_spec.rb DEV: Simplify CORS logic for public asset routes (#33106) 2025-06-09 08:58:27 +01:00
home_page_controller_spec.rb DEV: Add site description to crawler homepage view (#32845) 2025-05-22 08:33:59 +10:00
inline_onebox_controller_spec.rb SECURITY: Check topic visibility in Oneboxer even when categories match [backport 2026.1] 2026-03-31 15:12:50 +01:00
invites_controller_spec.rb SECURITY: Gate staged user fields on email verification [backport 2026.1] 2026-03-31 15:12:50 +01:00
list_controller_spec.rb SECURITY: Harden ListController top period query against SQL injection [backport 2026.1] (#41723) 2026-07-15 12:18:25 +08:00
metadata_controller_spec.rb SECURITY: Error responses missing Cache-Control header 2025-10-28 14:40:41 +08:00
net_http_header_spec.rb DEV: Add a user agent to all HTTP requests that Discourse makes. (#31555) 2025-03-03 16:32:25 +11:00
net_http_timeout_spec.rb
noscript_escape_spec.rb
notifications_controller_spec.rb FIX: Hide badge notifications for disabled badges or when badges are disabled (#36987) 2026-01-07 15:28:43 +08:00
offline_controller_spec.rb
omniauth_callbacks_controller_spec.rb FIX: Leave username blank during OAuth signup when no valid suggestion exists (#36830) 2026-01-08 11:02:35 +01:00
onebox_controller_spec.rb SECURITY: prevent hidden profile data leak via user onebox 2026-03-19 15:46:24 +00:00
permalinks_controller_spec.rb SECURITY: prevent permalink redirects from leaking restricted slugs 2026-01-28 17:11:14 +00:00
post_action_users_controller_spec.rb SECURITY: hide total_rows for restricted post action types 2026-03-19 15:46:24 +00:00
post_actions_controller_spec.rb SECURITY: fix is_warning type coercion bypass in PostActionsController 2026-03-19 15:46:24 +00:00
post_localizations_controller_spec.rb FEATURE: Allow post authors to localize their own posts (#36178) 2025-11-25 11:02:22 +08:00
post_readers_controller_spec.rb SECURITY: Missing post-level authorization allows whisper metadata disclosure [backport 2026.1] 2026-03-31 15:12:50 +01:00
posts_controller_spec.rb SECURITY: PostsController#raw_email leaks raw emails of inaccessible to mods [backport 2026.1] (#41966) 2026-07-23 16:37:00 +10:00
presence_controller_spec.rb
published_pages_controller_spec.rb DEV: Deprecate the assignment of nil to site settings (#36093) 2025-12-01 15:04:23 +08:00
push_notification_controller_spec.rb
qunit_controller_spec.rb DEV: Rename theme-transpiler to asset-processor (#35498) 2025-10-20 14:16:46 +01:00
reviewable_claimed_topics_controller_spec.rb DEV: Update spec expectations 2026-05-19 00:26:55 +01:00
reviewable_notes_controller_spec.rb SECURITY: scope reviewable notes to user-visible reviewables 2026-02-26 12:24:37 +00:00
reviewables_controller_spec.rb SECURITY: Reviewable conversations expose post-voting flag PM excerpts to category moderators outside the PM [backport 2026.1] (#41531) 2026-07-07 15:37:32 -05:00
robots_txt_controller_spec.rb
safe_mode_controller_spec.rb DEV: Compile 'common' CSS into own assets (#31416) 2025-05-01 10:44:49 +01:00
search_controller_spec.rb SECURITY: Apply category tag visibility to full-text search [backport 2026.1] (#41673) 2026-07-13 15:16:49 -03:00
session_controller_spec.rb DEV: Finish renaming secure_session to server_session 2025-09-23 10:35:02 +02:00
sidebar_sections_controller_spec.rb FIX: on edit, ensure community section remains at top of sidebar (#36597) 2025-12-10 12:26:35 -05:00
similar_topics_controller_spec.rb
site_controller_spec.rb DEV: Introduce stylelint (#29852) 2025-01-20 15:27:42 +00:00
sitemap_controller_spec.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
slugs_controller_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
static_controller_spec.rb SECURITY: Validate sso_destination_url cookie to prevent open redirect [backport 2026.1] 2026-03-31 15:12:50 +01:00
steps_controller_spec.rb UX: One step wizard (#36082) 2025-11-25 13:35:32 -05:00
stylesheets_controller_spec.rb
svg_sprite_controller_spec.rb DEV: enable raise_error in test envs for deprecated icons in svg_sprite.rb (#30980) 2025-02-04 21:21:20 +08:00
tag_groups_controller_spec.rb DEV: Add tests for parent_tag_name param in TagGroupsController (#37076) 2026-01-13 14:46:47 +08:00
tag_localizations_controller_spec.rb FEATURE: Introduce tag localizations with API, without UI yet (#36754) 2025-12-18 18:25:58 +08:00
tags_controller_spec.rb SECURITY: Don't leak restricted tag group names via tag info [backport 2026.1] 2026-05-19 00:26:55 +01:00
theme_javascripts_controller_spec.rb DEV: Use rollup for theme JS compilation (#33103) 2025-07-25 12:02:29 +01:00
topic_localizations_controller_spec.rb UX: Use inline title editor instead of composer when editing translation (#36847) 2025-12-24 00:56:36 +08:00
topic_view_stats_controller_spec.rb
topics_controller_spec.rb SECURITY: detailed_404 Security Setting Bypassed [backport 2026.1] (#41587) 2026-07-09 11:27:42 -05:00
uploads_controller_multisite_spec.rb
uploads_controller_spec.rb SECURITY: Regular users can route multipart uploads into the admin backup store [backport 2026.1] 2026-06-30 16:27:06 +02:00
user_actions_controller_spec.rb SECURITY: Enforce Guardian checks in UserActionsController#show 2026-03-19 15:46:24 +00:00
user_api_key_clients_controller_spec.rb Add user api key client rate limit settings (#30402) 2024-12-30 11:10:48 -05:00
user_api_keys_controller_spec.rb SECURITY: Validate auth_redirect in UserApiKeysController#new to prevent open redirect phishing 2026-03-19 15:46:24 +00:00
user_avatars_controller_spec.rb SECURITY: Improve SVG sanitization [backport 2026.1] 2026-06-30 16:27:06 +02:00
user_badges_controller_spec.rb SECURITY: Prevent badge lookup from exposing hidden profiles [backport 2026.1] (#41163) 2026-06-25 14:11:30 +08:00
user_status_controller_spec.rb FEATURE: Prevent silenced users from liking and using reactions (#37040) 2026-01-13 13:59:57 +01:00
users_controller_spec.rb SECURITY: An unauthorized user can delete emails of other users including Admins [backport 2026.1] (#41930) 2026-07-22 12:17:40 -05:00
users_email_controller_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
webhooks_controller_spec.rb SECURITY: Prevent any signed AWS SNS TopicARN from being accepted via webhooks [backport 2026.1] 2026-06-30 16:27:06 +02:00
wizard_controller_spec.rb