Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-06 13:08:40 +08:00
Code Packages Activity Actions
discourse/plugins/discourse-reactions
History
Exact
Isaac Janzen 811c8b2dd9
 SECURITY: anonymous users can read hidden real names via reaction-user endpoints [backport 2026.1] (#41935) 
Backport of #41931 to release/2026.1.

---

## Summary

Fix anonymous disclosure of hidden full names of reactors and likers via
reaction-user APIs when `enable_names` setting is disabled. The
`CustomReactionsController` now conditionally includes the `name` field
only when `enable_names` is enabled, ensuring the invariant that hidden
full names are not exposed to unauthenticated users.

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/1451

Co-authored-by: discourse-patch-triage
<272280883+discourse-patch-triage[bot]@users.noreply.github.com>
2026-07-22 14:11:22 -05:00
..
app SECURITY: anonymous users can read hidden real names via reaction-user endpoints [backport 2026.1] (#41935) 2026-07-22 14:11:22 -05:00
assets FIX: reactions z-index fix (#37038) 2026-01-14 11:03:19 -06:00
config I18N: Update translations (#37916) 2026-02-25 09:47:58 -05:00
db FEATURE: Promote discourse_reactions_allow_any_emoji out of experimental (#35589) 2025-10-24 16:51:18 +10:00
lib FEATURE: Prevent silenced users from liking and using reactions (#37040) 2026-01-13 13:59:57 +01:00
spec SECURITY: anonymous users can read hidden real names via reaction-user endpoints [backport 2026.1] (#41935) 2026-07-22 14:11:22 -05:00
test/javascripts FIX: discourse-reactions rollback not working (#36989) 2026-01-08 14:23:59 +10:00
package.json DEV: Overhaul typechecking configuration (#35794) 2025-11-12 12:54:34 +00:00
plugin.rb DEV: Add op_reactions_data to suggested topics (#36755) 2025-12-17 09:40:56 -06:00
README.md
tsconfig.json DEV: Overhaul typechecking configuration (#35794) 2025-11-12 12:54:34 +00:00

README.md

Discourse Reactions

Discourse-reactions is a plugin that allows user to add their reactions to the post.

For more information, please see: https://meta.discourse.org/t/discourse-reactions-beyond-likes/183261