Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-06 06:24:48 +08:00
Code Packages Activity Actions
discourse/plugins/discourse-data-explorer
History
Exact
Bannon Tanner f9f6863056
 SECURITY: Group report details expose raw Data Explorer SQL to non-admin group members [backport 2026.1] (#40951) 
Backport of #40919 to release/2026.1.

---

## Summary

Prevent the exposure of raw Data Explorer SQL to non-admin group members
when viewing report details. The sql attribute is now correctly gated to
administrators within the query details serializer.

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/1290
- Affected file:
https://github.com/discourse/discourse/blob/main/plugins/discourse-data-explorer/app/serializers/discourse_data_explorer/query_details_serializer.rb

---

🤖 Auto-generated from the patch diff via Patch Triage. Review carefully
before merging.

Co-authored-by: discourse-patch-triage
<272280883+discourse-patch-triage[bot]@users.noreply.github.com>
2026-06-16 14:28:31 -05:00
..
app SECURITY: Group report details expose raw Data Explorer SQL to non-admin group members [backport 2026.1] (#40951) 2026-06-16 14:28:31 -05:00
assets Build(deps): Bump chart.js from 3.5.1 to 4.5.1 (#35358) 2026-01-14 11:23:51 +01:00
config I18N: Update translations (#37916) 2026-02-25 09:47:58 -05:00
db/migrate
lib SECURITY: Ensure guardian check when creating QueryGroupBookmark 2026-02-26 12:24:37 +00:00
spec SECURITY: Group report details expose raw Data Explorer SQL to non-admin group members [backport 2026.1] (#40951) 2026-06-16 14:28:31 -05:00
test/javascripts DEV: Remove unneeded const self = this; from qunit tests (#35632) 2025-10-27 18:07:22 +00:00
package.json DEV: Overhaul typechecking configuration (#35794) 2025-11-12 12:54:34 +00:00
plugin.rb SECURITY: Check for no group assignments in data-explorer queries 2026-02-26 12:24:37 +00:00
README.md
tsconfig.json DEV: Overhaul typechecking configuration (#35794) 2025-11-12 12:54:34 +00:00

README.md

Data Explorer Plugin

This plugin allows admins to run SQL queries against the live Discourse database, including parameterized queries and formatting for several common column types.

For more information, please see: https://meta.discourse.org/t/data-explorer-plugin/32566