Exact

Exact Union RegExp

Joffrey JAFFEUX bb0934f5ab SECURITY: authentication bypass vulnerability ... When the patreon_webhook_secret site setting is blank, an attacker can forge valid webhook signatures by computing an HMAC-MD5 with an empty string as the key. Since the request body is known to the sender, the attacker can produce a matching signature and send arbitrary webhook payloads. This allows unauthorized creation, modification, or deletion of Patreon pledge data and triggering patron-to-group synchronization. The `secure_compare` change handles a very theoretical timing attack.		2026-02-26 12:24:37 +00:00
..
patreon_admin_controller.rb	DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073)	2025-10-06 16:11:01 +02:00
patreon_webhook_controller.rb	SECURITY: authentication bypass vulnerability	2026-02-26 12:24:37 +00:00