Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-06 13:08:40 +08:00
Code Packages Activity Actions
discourse/plugins/discourse-ai/spec
History
Exact
discoursebot d433b7e1e7
 SECURITY: Shared conversations and artifacts remain accessible [backport 2026.1] (#41560) 
Backport of #41554 to release/2026.1.

---

## Summary

Prevent unauthorized access to shared AI conversations and artifacts by
verifying the visibility of source topics and posts before rendering.
The patch also ensures that destroying a shared conversation correctly
restores privacy settings for artifacts and uploads even when the source
topic has been trashed.

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/1398

Co-authored-by: discourse-patch-triage
<272280883+discourse-patch-triage[bot]@users.noreply.github.com>

Co-authored-by: Isaac Janzen <50783505+janzenisaac@users.noreply.github.com>
2026-07-08 15:02:39 -05:00
..
configuration DEV: migrate enabled_chat_bot column to a setting (#36707) 2025-12-17 09:26:19 -08:00
db/migrate DEV: Fix random typos (#33839) 2025-07-24 22:04:13 +02:00
evals FEATURE: Format eval comparison results into a table (#36724) 2025-12-16 12:58:43 -03:00
fabricators DEV: Remove deprecated daily_usage (#36570) 2025-12-18 09:45:02 -08:00
fixtures
jobs SECURITY: Shared conversations and artifacts remain accessible [backport 2026.1] (#41560) 2026-07-08 15:02:39 -05:00
lib SECURITY: Harden imagemagick execution [backport 2026.1] 2026-06-30 16:27:06 +02:00
models SECURITY: Stored XSS in discourse-ai shared conversations onebox [backport 2026.1] 2026-03-31 15:12:50 +01:00
reports
requests SECURITY: Shared conversations and artifacts remain accessible [backport 2026.1] (#41560) 2026-07-08 15:02:39 -05:00
serializers SECURITY: Force regeneration for edit-outdated summaries and block stale fallback [backport 2026.1] 2026-03-31 15:12:50 +01:00
services SECURITY: Force regeneration for edit-outdated summaries and block stale fallback [backport 2026.1] 2026-03-31 15:12:50 +01:00
shared/inference DEV: Make persona image tools platform agnostic (#36195) 2025-11-26 09:36:24 -08:00
support
system FIX: ensures ai_bot_enabled_llms works correctly (#37269) 2026-01-22 18:15:44 +01:00
tasks DEV: Remove old Discourse AI rake tasks (#36384) 2025-12-02 14:34:08 -03:00
plugin_helper.rb DEV: migrate enabled_chat_bot column to a setting (#36707) 2025-12-17 09:26:19 -08:00
plugin_spec.rb FEATURE: configure a default LLM model for all features (#33752) 2025-07-28 16:08:00 -03:00