Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-09 21:45:25 +08:00
Code Packages Activity Actions
discourse/plugins/discourse-ai/app/controllers/discourse_ai
History
Exact
discoursebot d433b7e1e7
 SECURITY: Shared conversations and artifacts remain accessible [backport 2026.1] (#41560) 
Backport of #41554 to release/2026.1.

---

## Summary

Prevent unauthorized access to shared AI conversations and artifacts by
verifying the visibility of source topics and posts before rendering.
The patch also ensures that destroying a shared conversation correctly
restores privacy settings for artifacts and uploads even when the source
topic has been trashed.

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/1398

Co-authored-by: discourse-patch-triage
<272280883+discourse-patch-triage[bot]@users.noreply.github.com>

Co-authored-by: Isaac Janzen <50783505+janzenisaac@users.noreply.github.com>
2026-07-08 15:02:39 -05:00
..
admin DEV: migrate enabled_chat_bot column to a setting (#36707) 2025-12-17 09:26:19 -08:00
ai_bot SECURITY: Shared conversations and artifacts remain accessible [backport 2026.1] (#41560) 2026-07-08 15:02:39 -05:00
ai_helper UX: Improvements to flow when credit limits are exceeded (#36360) 2025-12-01 12:27:30 -08:00
discord DEV: Clean up scope resolution operators in plugins (#34979) 2025-09-30 14:36:34 +02:00
discover SECURITY: Enforce group-access restrictions to AI discover’s continue convo. 2026-01-28 17:11:14 +00:00
embeddings FIX: handle embedding API failures gracefully in semantic search (#37112) 2026-01-14 14:04:41 -03:00
sentiment SECURITY: Scope sentiment posts endpoint to allowed categories [backport 2026.1] 2026-03-31 15:12:50 +01:00
summarization SECURITY: Force regeneration for edit-outdated summaries and block stale fallback [backport 2026.1] 2026-03-31 15:12:50 +01:00
translation FIX: Also automatically translate to site's default locale (#37292) 2026-01-24 00:08:34 +08:00
ai_credits_controller.rb SECURITY: Unscoped status lookups leak restricted metadata 2026-03-19 15:46:24 +00:00