0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-06 13:08:40 +08:00
discourse/plugins/chat/spec
discoursebot bfc93106a0
SECURITY: Enforce recipient PM allowlists for existing direct chat channels [backport 2026.1] (#41926)
Backport of #41923 to release/2026.1.

---

## Summary

Correctly enforce the PM allowlist preference
(`enable_allowed_pm_users`) when an excluded user attempts to send a
message in an existing one-to-one direct message channel. Previously,
the Guardian helper did not check the allowlist, allowing excluded users
to continue sending messages after the recipient enabled the
restriction. The fix integrates `UserCommScreener` into the recipient
authorization check, also preventing thread creation and updating user
card chat availability accordingly.

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/1454

Co-authored-by: discourse-patch-triage
<272280883+discourse-patch-triage[bot]@users.noreply.github.com>

---------

Co-authored-by: Isaac Janzen <50783505+janzenisaac@users.noreply.github.com>
Co-authored-by: Isaac Janzen <isaac.janzen@discourse.org>
2026-07-22 12:12:08 -05:00
..
components/chat FEATURE: separate chat emails from regular emails (#36018) 2025-11-13 16:44:07 +04:00
fabricators FEATURE: disable chat DM threads by default (#34840) 2025-09-17 16:52:13 +04:00
integration DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
jobs FIX: Skip notifications when rebaking chat messages from GitHub webhooks (#36577) 2025-12-10 01:08:36 +01:00
lib SECURITY: Enforce recipient PM allowlists for existing direct chat channels [backport 2026.1] (#41926) 2026-07-22 12:12:08 -05:00
mailers FEATURE: separate chat emails from regular emails (#36018) 2025-11-13 16:44:07 +04:00
models FEATURE: GitHub PR live status icon (#36313) 2025-12-04 21:42:44 +01:00
queries/chat DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
requests SECURITY: Enforce recipient PM allowlists for existing direct chat channels [backport 2026.1] (#41926) 2026-07-22 12:12:08 -05:00
serializer SECURITY: Chat authorization and disclosure fixes [backport 2026.1] 2026-05-19 00:26:55 +01:00
services SECURITY: Enforce chat message length before cooking it [backport 2026.1] (#41753) 2026-07-16 11:10:40 +08:00
support FEATURE: Ability to star chat channels (#36142) 2025-12-03 09:25:08 -08:00
system FIX: dynamic highlighting of self mentions (#37321) 2026-01-28 14:59:48 +04:00
validators FEATURE: Add setting to prevent anonymous users from using chat (#31842) 2025-03-21 13:32:52 +03:00
plugin_helper.rb SECURITY: Restrict public chat MessageBus broadcasts to chat-eligible users [backport 2026.1] 2026-05-19 00:26:55 +01:00
plugin_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00