Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-06 13:08:40 +08:00
Code Packages Activity Actions
discourse/plugins/discourse-subscriptions/spec
History
Exact
discoursebot c774474881
 SECURITY: Subscription contributors expose full user profile fields to anonymous viewers [backport 2026.1] (#40894) 
Backport of #40891 to release/2026.1.

---

## Summary

Correctly enforce profile visibility restrictions in the subscriptions
contributors endpoint and user serializers. This prevents the exposure
of sensitive profile fields—including bio, location, and website—to
anonymous viewers when public profiles are disabled via site settings.
The fix also hardens the user and user card serializers to omit profile
details for unauthorized scopes as a defense-in-depth measure.

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/1286

Co-authored-by: discourse-patch-triage
<272280883+discourse-patch-triage[bot]@users.noreply.github.com>

Co-authored-by: Isaac Janzen <50783505+janzenisaac@users.noreply.github.com>
2026-06-15 10:24:34 -05:00
..
fabricators
fixtures/json
jobs DEV: Remove unnecessary rails_helper requires (#33812) 2025-07-24 13:50:04 +02:00
models DEV: Remove unnecessary rails_helper requires (#33812) 2025-07-24 13:50:04 +02:00
requests SECURITY: Subscription contributors expose full user profile fields to anonymous viewers [backport 2026.1] (#40894) 2026-06-15 10:24:34 -05:00
serializers DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
services SECURITY: Fixes for discourse-subscriptions [backport 2026.1] 2026-03-31 15:12:50 +01:00
system DEV: Fix broken pricing table system test in discourse-subscriptions (#35260) 2025-10-08 15:30:30 +08:00
plugin_helper.rb