Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-06 00:15:24 +08:00
Code Packages Activity Actions
discourse/plugins
History
Exact
Isaac Janzen 811c8b2dd9
 SECURITY: anonymous users can read hidden real names via reaction-user endpoints [backport 2026.1] (#41935) 
Backport of #41931 to release/2026.1.

---

## Summary

Fix anonymous disclosure of hidden full names of reactors and likers via
reaction-user APIs when `enable_names` setting is disabled. The
`CustomReactionsController` now conditionally includes the `name` field
only when `enable_names` is enabled, ensuring the invariant that hidden
full names are not exposed to unauthenticated users.

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/1451

Co-authored-by: discourse-patch-triage
<272280883+discourse-patch-triage[bot]@users.noreply.github.com>
2026-07-22 14:11:22 -05:00
..
automation I18N: Update translations (#37916) 2026-02-25 09:47:58 -05:00
chat SECURITY: Enforce recipient PM allowlists for existing direct chat channels [backport 2026.1] (#41926) 2026-07-22 12:12:08 -05:00
checklist DEV: upgrade to fontawesome 7 (#36286) 2026-01-14 12:58:36 +01:00
discourse-adplugin I18N: Update translations (#37916) 2026-02-25 09:47:58 -05:00
discourse-affiliate I18N: Update translations (#37916) 2026-02-25 09:47:58 -05:00
discourse-ai SECURITY: Shared conversations and artifacts remain accessible [backport 2026.1] (#41560) 2026-07-08 15:02:39 -05:00
discourse-apple-auth I18N: Update translations (#37916) 2026-02-25 09:47:58 -05:00
discourse-assign SECURITY: Honor group visibility in discourse-assign group lookups [backport 2026.1] (#41198) 2026-06-25 13:58:03 -03:00
discourse-cakeday I18N: Update translations (#37056) 2026-01-12 15:18:57 +01:00
discourse-calendar SECURITY: Gate private event invitee details [backport 2026.1] 2026-06-30 16:27:06 +02:00
discourse-chat-integration I18N: Update translations (#37916) 2026-02-25 09:47:58 -05:00
discourse-data-explorer SECURITY: Group report details expose raw Data Explorer SQL to non-admin group members [backport 2026.1] (#40951) 2026-06-16 14:28:31 -05:00
discourse-details I18N: Update translations (#37916) 2026-02-25 09:47:58 -05:00
discourse-gamification I18N: Update translations (#37916) 2026-02-25 09:47:58 -05:00
discourse-github I18N: Update translations (#37916) 2026-02-25 09:47:58 -05:00
discourse-graphviz SECURITY: Prevent Sidekiq DoS via Graphviz rendering [backport 2026.1] (#40752) 2026-06-10 18:13:50 +01:00
discourse-hcaptcha I18N: Update translations (#37916) 2026-02-25 09:47:58 -05:00
discourse-lazy-videos UX: add admin sidebar icons for preinstalled plugins (#36764) 2025-12-18 16:39:00 -05:00
discourse-local-dates I18N: Update translations (#37916) 2026-02-25 09:47:58 -05:00
discourse-login-with-amazon I18N: Update translations (#37916) 2026-02-25 09:47:58 -05:00
discourse-lti I18N: Update translations (#37101) 2026-01-14 09:39:58 +01:00
discourse-math I18N: Update translations (#37916) 2026-02-25 09:47:58 -05:00
discourse-microsoft-auth I18N: Update translations (#37056) 2026-01-12 15:18:57 +01:00
discourse-narrative-bot I18N: Update translations (#37916) 2026-02-25 09:47:58 -05:00
discourse-oauth2-basic I18N: Update translations (#37916) 2026-02-25 09:47:58 -05:00
discourse-openid-connect I18N: Update translations (#37916) 2026-02-25 09:47:58 -05:00
discourse-patreon SECURITY: authentication bypass vulnerability 2026-02-26 12:24:37 +00:00
discourse-policy SECURITY: Validate policy permissions on post save 2026-03-19 15:46:24 +00:00
discourse-post-voting SECURITY: Reviewable conversations expose post-voting flag PM excerpts to category moderators outside the PM [backport 2026.1] (#41531) 2026-07-07 15:37:32 -05:00
discourse-presence SECURITY: Authorization bypass in wiki edit presence leaks editor identities [backport 2026.1] (#41482) 2026-07-06 14:06:51 -05:00
discourse-reactions SECURITY: anonymous users can read hidden real names via reaction-user endpoints [backport 2026.1] (#41935) 2026-07-22 14:11:22 -05:00
discourse-rewind I18N: Update translations (#37916) 2026-02-25 09:47:58 -05:00
discourse-rss-polling I18N: Update translations (#37916) 2026-02-25 09:47:58 -05:00
discourse-solved SECURITY: /solution/by_user leaks whisper/hidden accepted-answer post [backport 2026.1] (#41492) 2026-07-07 10:42:46 -05:00
discourse-subscriptions SECURITY: Subscription contributors expose full user profile fields to anonymous viewers [backport 2026.1] (#40894) 2026-06-15 10:24:34 -05:00
discourse-templates I18N: Update translations (#37916) 2026-02-25 09:47:58 -05:00
discourse-topic-voting I18N: Update translations (#37916) 2026-02-25 09:47:58 -05:00
discourse-user-notes SECURITY: Unauthorized Post Data Exposure in discourse-user-notes Plugin 2026-03-19 15:46:24 +00:00
discourse-zendesk-plugin SECURITY: Block ticket creation when user can't see the topic 2026-03-19 15:46:24 +00:00
footnote I18N: Update translations (#37916) 2026-02-25 09:47:58 -05:00
poll SECURITY: Uncontrolled Resource Consumption in Number Poll Generation [backport 2026.1] (#41151) 2026-06-24 15:53:17 +10:00
spoiler-alert I18N: Update translations (#37916) 2026-02-25 09:47:58 -05:00
styleguide I18N: Update translations (#37916) 2026-02-25 09:47:58 -05:00