Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-09 21:45:25 +08:00
Code Packages Activity Actions
discourse/plugins/chat/lib
History
Exact
discoursebot bfc93106a0
 SECURITY: Enforce recipient PM allowlists for existing direct chat channels [backport 2026.1] (#41926) 
Backport of #41923 to release/2026.1.

---

## Summary

Correctly enforce the PM allowlist preference
(`enable_allowed_pm_users`) when an excluded user attempts to send a
message in an existing one-to-one direct message channel. Previously,
the Guardian helper did not check the allowlist, allowing excluded users
to continue sending messages after the recipient enabled the
restriction. The fix integrates `UserCommScreener` into the recipient
authorization check, also preventing thread creation and updating user
card chat availability accordingly.

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/1454

Co-authored-by: discourse-patch-triage
<272280883+discourse-patch-triage[bot]@users.noreply.github.com>

---------

Co-authored-by: Isaac Janzen <50783505+janzenisaac@users.noreply.github.com>
Co-authored-by: Isaac Janzen <isaac.janzen@discourse.org>
2026-07-22 12:12:08 -05:00
..
chat SECURITY: Enforce recipient PM allowlists for existing direct chat channels [backport 2026.1] (#41926) 2026-07-22 12:12:08 -05:00
chat_sdk DEV: correctly returns contract error (#32645) 2025-05-08 14:30:02 +02:00
discourse_dev DEV: Refactor Chat::ListChannelThreadMessages a bit (#33380) 2025-08-08 14:05:38 +02:00
email_controller_helper
onebox/templates FiX: Update date url for thread oneboxes (#24172) 2023-10-31 08:04:40 -03:00
tasks DEV: fix chat:*:populate rake tasks (#29740) 2024-11-13 18:11:25 +01:00