Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-06 09:44:06 +08:00
Code Packages Activity Actions
discourse/spec
History
Exact
discourse-patch-triage[bot] 66542af04e
 SECURITY: DoS vis uncapped Bulk Topic Actions [backport 2026.1] (#42004) 
Backport of #42001 to release/2026.1.

---

## Summary

Limit and deduplicate topic_ids for bulk actions.

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/1477

Co-authored-by: discourse-patch-triage
<272280883+discourse-patch-triage[bot]@users.noreply.github.com>

Co-authored-by: David Taylor <david@taylorhq.com>
2026-07-23 23:07:07 +01:00
..
db/migrate DEV: Add slugs to tag model (#36985) 2026-01-08 11:03:01 +08:00
fabricators SECURITY: Add guardian check on PM to topic conversion 2026-01-28 17:11:14 +00:00
fixtures DEV: use minimally necessary encoding in html_reply.eml fixture 2026-01-15 13:05:25 -05:00
generator DEV: Remove deprecated trust level access settings (#36414) 2025-12-11 11:09:29 +10:00
helpers SECURITY: Bind shared session key to auth token and enforce user gates [backport 2026.1] (#41691) 2026-07-14 15:48:25 +08:00
import_export
initializers SECURITY: Harden imagemagick execution [backport 2026.1] 2026-06-30 16:27:06 +02:00
integration FIX: do not use public IP address space for tests 2025-12-16 09:35:01 -05:00
integrity PERF: Reject anonymous requests with 503 upon aggressive queuing (#36519) 2025-12-18 10:23:42 +08:00
jobs SECURITY: Authorize secure-upload hotlink downloads against post user [backport 2026.1] 2026-06-30 16:27:06 +02:00
lib SECURITY: Unsanitized TagLocalization Descriptions [backport 2026.1] (#41562) 2026-07-15 08:49:44 -05:00
mailers DEV: Remove IMAP support in Discourse (#37002) 2026-01-12 10:07:26 +10:00
models SECURITY: Harden ListController top period query against SQL injection [backport 2026.1] (#41723) 2026-07-15 12:18:25 +08:00
multisite FEATURE: Notify admins of upcoming changes and log events (#37003) 2026-01-21 12:45:54 +10:00
queries/reports FEATURE: Add admin-only reports and centralize report visibility logic 2026-01-28 17:11:14 +00:00
requests SECURITY: DoS vis uncapped Bulk Topic Actions [backport 2026.1] (#42004) 2026-07-23 23:07:07 +01:00
script/import_scripts
serializers SECURITY: /directory_items leaks restricted user-field values [backport 2026.1] (#41485) 2026-07-06 14:26:20 -05:00
services SECURITY: Stale featured rows expose unlisted topic content [backport 2026.1] (#41813) 2026-07-17 09:40:52 -05:00
support DEV: Remove IMAP support in Discourse (#37002) 2026-01-12 10:07:26 +10:00
system SECURITY: XSS in review queue via highlightWatchedWords 2026-03-19 15:46:24 +00:00
tasks DEV: Update stage_security_fixes rake task (#37346) 2026-01-28 15:12:29 +00:00
views FIX: remove ItemList schema from linkbacks in crawler view (#36608) 2025-12-11 10:41:47 +01:00
rails_helper.rb DEV: Use CDP to override browser timezone in system specs (#36880) 2025-12-29 09:23:17 +10:00
regenerate_swagger_docs
swagger_helper.rb DEV: add api docs for discourse-calendar events index endpoint (#35400) 2025-10-16 07:39:08 +08:00