Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-06 13:08:40 +08:00
Code Packages Activity Actions
discourse/spec/models
History
Exact
Alan Guo Xiang Tan c35b9ff110
 SECURITY: Harden ListController top period query against SQL injection [backport 2026.1] (#41723) 
Backport of #41718 to release/2026.1.

---

A category's `default_top_period` was interpolated raw into the
top-topic
score predicate in `ListController` before the period was validated
against
the allowlist. For anonymous requests to a category whose default view
is
`top`, an attacker-planted value reached the SQL predicate directly. The
response never returns the query's data, but it changes depending on
whether
an injected condition holds, so an attacker can read data one yes/no
answer at
a time.

This is hardening rather than a critical fix because the column is
`varchar(20)`: PostgreSQL rejects an over-long value, leaving no room
for a
subquery or a second statement. An attacker could only probe one value
at a
time, for example reading the PostgreSQL session role character by
character,
not perform arbitrary reads or writes.

Harden the path in depth:

- Sanitise the category-derived period in `best_period_for`, falling
back to
the site default when it is not a known period, so the untrusted value
never
  reaches SQL.
- Build the score column in `best_period_with_topics_for` through the
validating `TopTopic.score_column_for_period` helper instead of raw
string
  interpolation.
- Clear `Category#default_top_period` on validation when it is not a
known
period, so an invalid value is never stored and the category falls back
to
  the site default at read time.
2026-07-15 12:18:25 +08:00
..
concerns FEATURE: Add support for uploads on translated posts (#35871) 2025-11-12 08:55:21 -08:00
about_spec.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
admin_dashboard_data_spec.rb DEV: Remove old problem check system - part 2 (#34403) 2025-08-20 16:15:21 +08:00
admin_notice_spec.rb DEV: Database backed admin notices (#26192) 2024-05-23 09:29:08 +08:00
api_key_scope_spec.rb FIX: Logs api scope not working (#25215) 2024-01-10 19:30:10 -07:00
api_key_spec.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
application_request_spec.rb DEV: Apply syntax_tree formatting to spec/* 2023-01-09 11:49:28 +00:00
associated_group_spec.rb DEV: Apply syntax_tree formatting to spec/* 2023-01-09 11:49:28 +00:00
badge_grouping_spec.rb DEV: Remove unnecessary rails_helper requiring (#26364) 2024-03-26 11:32:01 +01:00
badge_spec.rb FIX: Allow badges with SQL queries to be manually granted (#36866) 2026-01-09 13:58:09 +01:00
badge_type_spec.rb DEV: Apply syntax_tree formatting to spec/* 2023-01-09 11:49:28 +00:00
bookmark_spec.rb FIX: notification reminder is deleted with bookmark (#35141) 2025-10-03 08:34:19 +02:00
category_featured_topic_spec.rb DEV: Convert min_trust_to_create_topic to groups (#24740) 2023-12-13 14:50:13 +11:00
category_group_spec.rb DEV: Enable RSpec/InstanceVariable rule for models 2025-02-17 10:00:08 +01:00
category_list_spec.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
category_localization_spec.rb FEATURE: Show translated category names from localizations table if they exist for the user locale (#32380) 2025-04-22 15:13:19 +08:00
category_setting_spec.rb FEATURE: Configurable auto-bump cooldown (#20507) 2023-03-10 13:45:01 +08:00
category_spec.rb SECURITY: Harden ListController top period query against SQL injection [backport 2026.1] (#41723) 2026-07-15 12:18:25 +08:00
category_tag_stat_spec.rb DEV: Allow fab! without block (#24314) 2023-11-09 16:47:59 -06:00
category_user_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
child_theme_spec.rb DEV: Apply syntax_tree formatting to spec/* 2023-01-09 11:49:28 +00:00
color_scheme_color_spec.rb DEV: Apply syntax_tree formatting to spec/* 2023-01-09 11:49:28 +00:00
color_scheme_spec.rb FEATURE: Allow editing theme-owned palettes (#34722) 2025-10-06 09:02:39 +03:00
developer_spec.rb
digest_email_site_setting_spec.rb DEV: Apply syntax_tree formatting to spec/* 2023-01-09 11:49:28 +00:00
directory_item_spec.rb PERF: DirectoryItem.refresh! daily can take an extremely long time (#35860) 2025-11-10 13:23:23 +10:00
discourse_connect_spec.rb DEV: Finish renaming secure_session to server_session 2025-09-23 10:35:02 +02:00
do_not_disturb_timing_spec.rb DEV: Allow fab! without block (#24314) 2023-11-09 16:47:59 -06:00
draft_sequence_spec.rb FEATURE: Multiple Draft Topics (#30790) 2025-01-29 10:23:26 +04:00
draft_spec.rb FIX: certain edge cases could leave phantom drafts behind (#37130) 2026-01-16 13:17:18 +11:00
email_change_request_spec.rb DEV: Apply syntax_tree formatting to spec/* 2023-01-09 11:49:28 +00:00
email_log_spec.rb DEV: Allow fab! without block (#24314) 2023-11-09 16:47:59 -06:00
email_token_spec.rb DEV: Enable RSpec/InstanceVariable rule for models 2025-02-17 10:00:08 +01:00
embeddable_host_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
embeddable_host_tag_spec.rb FEATURE: Extend embeddable hosts with Individual tags and author assignments (#26868) 2024-05-16 15:47:01 -04:00
emoji_spec.rb FIX: Emoji.exists? should be consistent with Emoji[] (#36347) 2025-12-01 18:58:30 +01:00
flag_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
form_template_spec.rb DEV: Fix flaky test for form template (#33960) 2025-07-30 13:55:26 +10:00
given_daily_like_spec.rb DEV: Allow fab! without block (#24314) 2023-11-09 16:47:59 -06:00
global_setting_spec.rb FIX: GlobalSetting should treat negative integers as integers (#36276) 2025-11-26 15:52:19 -08:00
group_archived_message_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
group_associated_group_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
group_history_spec.rb DEV: Allow fab! without block (#24314) 2023-11-09 16:47:59 -06:00
group_request_spec.rb DEV: Bump the limits on group request text fields 2023-05-24 09:57:46 +02:00
group_spec.rb DEV: Remove IMAP support in Discourse (#37002) 2026-01-12 10:07:26 +10:00
group_user_spec.rb FIX: Skip trust level changes when group grant_trust_level is 0 (#35572) 2025-10-23 14:23:25 -04:00
incoming_link_spec.rb DEV: Allow fab! without block (#24314) 2023-11-09 16:47:59 -06:00
incoming_links_report_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
invite_redeemer_spec.rb DEV: Migrate user passwords data to UserPassword table (#28746) 2024-10-10 09:23:06 +08:00
invite_spec.rb FIX: reduce redemption_count when invited user is destroyed (#35695) 2025-10-30 13:43:51 +11:00
javascript_cache_spec.rb DEV: Apply syntax_tree formatting to spec/* 2023-01-09 11:49:28 +00:00
locale_site_setting_spec.rb FEATURE: Localize language names (#33790) 2025-07-29 11:48:45 +08:00
mailing_list_mode_site_setting_spec.rb DEV: Apply syntax_tree formatting to spec/* 2023-01-09 11:49:28 +00:00
moved_post_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
notification_spec.rb FIX: Hide badge notifications for badges that have been deleted (#36990) 2026-01-08 08:21:00 +08:00
onebox_locale_site_setting_spec.rb FEATURE: Add a onebox_locale site setting. (#30655) 2025-01-09 14:11:37 +11:00
optimized_image_spec.rb SECURITY: Harden imagemagick execution [backport 2026.1] 2026-06-30 16:27:06 +02:00
optimized_video_spec.rb DEV: Ensure optimized videos have the correct acl (#36364) 2025-12-01 19:50:08 -07:00
permalink_spec.rb SECURITY: prevent permalink redirects from leaking restricted slugs 2026-01-28 17:11:14 +00:00
plugin_store_spec.rb DEV: Apply syntax_tree formatting to spec/* 2023-01-09 11:49:28 +00:00
post_action_spec.rb FIX: Topic creation failure when enabled category moderation (#36094) 2025-11-19 14:07:10 +08:00
post_action_type_spec.rb DEV: Enable RSpec/InstanceVariable rule for models 2025-02-17 10:00:08 +01:00
post_analyzer_spec.rb DEV: Apply syntax_tree formatting to spec/* 2023-01-09 11:49:28 +00:00
post_detail_spec.rb
post_localization_spec.rb FEATURE: Add support for uploads on translated posts (#35871) 2025-11-12 08:55:21 -08:00
post_mover_spec.rb FEATURE: when moving posts to a PM also add acting user (#36789) 2025-12-22 14:10:41 +11:00
post_reply_key_spec.rb DEV: Apply syntax_tree formatting to spec/* 2023-01-09 11:49:28 +00:00
post_reply_spec.rb DEV: Allow fab! without block (#24314) 2023-11-09 16:47:59 -06:00
post_revision_spec.rb DEV: Apply syntax_tree formatting to spec/* 2023-01-09 11:49:28 +00:00
post_spec.rb SECURITY: fix loose hostname matching in spam host allowlist 2026-03-19 15:46:24 +00:00
post_stripper_spec.rb FIX: user got notified about a mention inside a chat message quote (#24229) 2023-11-08 23:13:25 +04:00
post_timing_spec.rb FIX: update PM tracking state when marking messages as unread (#36258) 2025-11-26 18:29:35 +01:00
private_message_topic_tracking_state_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
problem_check_tracker_spec.rb DEV: Remove admin notices when destroying problem check trackers (#35976) 2025-11-13 10:34:28 +08:00
published_page_spec.rb DEV: Allow fab! without block (#24314) 2023-11-09 16:47:59 -06:00
quoted_post_spec.rb DEV: Fix a flaky quote post spec (#22891) 2023-08-01 00:48:40 +02:00
remote_theme_spec.rb DEV: Only load specific plugin bundles during qunit test (#33678) 2025-07-21 21:00:48 +01:00
report_spec.rb SECURITY: Do not leak PM post edits to moderators 2026-03-19 15:46:24 +00:00
reviewable_action_log_spec.rb DEV: Log Reviewable actions (#36076) 2025-11-20 13:41:40 +11:00
reviewable_claimed_topic_spec.rb FEATURE: Sync Reviewable Status (#31901) 2025-03-24 14:27:18 +11:00
reviewable_flagged_post_spec.rb FIX: Include user in /reviewable_claimed message (#37190) 2026-01-19 14:46:40 +08:00
reviewable_history_spec.rb DEV: Convert min_trust_to_flag_posts setting to groups (#24864) 2023-12-13 17:18:42 +08:00
reviewable_note_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
reviewable_post_spec.rb FIX: Restore post editing in the new reviewable UI (#35784) 2025-11-05 08:34:32 +08:00
reviewable_queued_post_spec.rb UX: refactor review queue buttons for more consistent language (#36812) 2026-01-13 10:17:29 -05:00
reviewable_score_spec.rb DEV: Automatically update groups for test users with explicit TL (#25415) 2024-01-29 17:52:02 +08:00
reviewable_spec.rb FIX: keeps force_review once set to true (#38795) (#38986) 2026-03-30 15:54:28 -03:00
reviewable_user_spec.rb FEATURE: Update the ReviewableUser UI for the review queue refresh. (#35515) 2025-10-29 08:54:08 +08:00
s3_region_site_setting_spec.rb DEV: Apply syntax_tree formatting to spec/* 2023-01-09 11:49:28 +00:00
screened_email_spec.rb DEV: Update the rubocop-discourse gem 2023-06-26 11:41:52 +02:00
screened_ip_address_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
screened_url_spec.rb DEV: Enable RSpec/InstanceVariable rule for models 2025-02-17 10:00:08 +01:00
search_log_spec.rb DEV: Add search_log modifier to prevent search log logging (#28279) 2024-08-08 12:41:10 -05:00
sidebar_section_link_spec.rb DEV: Allow fab! without block (#24314) 2023-11-09 16:47:59 -06:00
sidebar_section_spec.rb FEATURE: dynamic search when in /filter route (#33614) 2025-07-22 16:08:10 +10:00
sidebar_url_spec.rb FIX: increase sidebar URL limit to 1000 (#23120) 2023-08-17 14:46:24 +10:00
site_setting_spec.rb FIX: Also automatically translate to site's default locale (#37292) 2026-01-24 00:08:34 +08:00
site_spec.rb FEATURE: Split setting for allowing mods to manage categories and groups (#35174) 2025-10-06 10:43:42 +03:00
sitemap_spec.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
skipped_email_log_spec.rb DEV: Apply syntax_tree formatting to spec/* 2023-01-09 11:49:28 +00:00
stylesheet_cache_spec.rb DEV: Apply syntax_tree formatting to spec/* 2023-01-09 11:49:28 +00:00
tag_group_spec.rb FEATURE: allow filtering of tag groups with special chars (#37049) 2026-01-13 11:53:08 +11:00
tag_localization_spec.rb DEV: Add tag localization tables (#35962) 2025-11-11 20:39:54 +08:00
tag_spec.rb DEV: Add slugs to tag model (#36985) 2026-01-08 11:03:01 +08:00
tag_user_spec.rb FEATURE: Convert watched_precedence_over_muted to default site setting (#35671) 2025-10-30 10:04:18 +10:00
theme_field_spec.rb DEV: Use rollup for theme JS compilation (#33103) 2025-07-25 12:02:29 +01:00
theme_modifier_set_spec.rb DEV: Apply syntax_tree formatting to spec/* 2023-01-09 11:49:28 +00:00
theme_setting_spec.rb DEV: Refactor and add missing tests for upload type in objects schema (#36285) 2025-11-28 04:02:23 +08:00
theme_settings_migration_spec.rb FEATURE: Theme settings migrations (#24071) 2023-11-02 08:10:15 +03:00
theme_site_setting_spec.rb DEV: Refactor and add missing tests for upload type in objects schema (#36285) 2025-11-28 04:02:23 +08:00
theme_spec.rb FEATURE: enhance screenshot support for themes with dark/light modes (#36422) 2025-12-10 11:23:21 +10:00
theme_svg_sprite_spec.rb DEV: Allow fab! without block (#24314) 2023-11-09 16:47:59 -06:00
top_menu_item_spec.rb DEV: Apply syntax_tree formatting to spec/* 2023-01-09 11:49:28 +00:00
top_topic_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
topic_allowed_user_spec.rb
topic_converter_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
topic_embed_spec.rb FIX: Use oEmbed for YouTube oneboxing (#35959) 2025-11-12 14:13:16 +10:00
topic_featured_users_spec.rb DEV: Apply syntax_tree formatting to spec/* 2023-01-09 11:49:28 +00:00
topic_group_spec.rb DEV: Enable RSpec/InstanceVariable rule for models 2025-02-17 10:00:08 +01:00
topic_hot_scores_spec.rb FIX: Exclude unlisted topics from hot scores (#37312) 2026-01-27 13:46:57 +11:00
topic_invite_spec.rb DEV: Apply syntax_tree formatting to spec/* 2023-01-09 11:49:28 +00:00
topic_link_click_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
topic_link_spec.rb FIX: Filter orphaned TopicLinks and normalize http URLs to https (#37098) 2026-01-15 12:12:34 +08:00
topic_list_spec.rb FIX: Inconsistent op_like_count serialization with serialize_topic_op_likes_data (#36950) 2026-01-07 19:12:22 +01:00
topic_localization_spec.rb DEV: Add rake task to backfill localization excerpts which were empty (#36901) 2025-12-30 17:04:36 +08:00
topic_participant_groups_summary_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
topic_participants_summary_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
topic_posters_summary_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
topic_spec.rb SECURITY: Normalize and escape topic featured links [backport 2026.1] 2026-06-30 16:27:06 +02:00
topic_tag_spec.rb DEV: Allow fab! without block (#24314) 2023-11-09 16:47:59 -06:00
topic_thumbnail_spec.rb DEV: Fix random typos (#22078) 2023-06-13 22:02:21 +02:00
topic_timer_spec.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
topic_tracking_state_spec.rb DEV: Add topic_tracking_state_publish_unread_scope modifier (#37236) 2026-01-21 17:59:33 +08:00
topic_user_spec.rb DEV: Enable RSpec/InstanceVariable rule for models 2025-02-17 10:00:08 +01:00
topic_view_item_spec.rb FEATURE: topic_view_stats table with daily fidelity (#27197) 2024-05-27 15:25:32 +10:00
translation_override_spec.rb DEV: Refresh translation override status when updating (#31233) 2025-02-07 14:12:28 +08:00
trust_level3_requirements_spec.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
trust_level_and_staff_setting_spec.rb DEV: Apply syntax_tree formatting to spec/* 2023-01-09 11:49:28 +00:00
trust_level_setting_spec.rb DEV: Fix flaky deprecated setting specs (#30550) 2025-01-04 12:55:22 +01:00
unsubscribe_key_spec.rb DEV: Allow fab! without block (#24314) 2023-11-09 16:47:59 -06:00
upload_reference_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
upload_spec.rb DEV: Better protection for drafts 2026-01-28 17:11:14 +00:00
user_action_spec.rb SECURITY: Restrict user action removal messages [backport 2026.1] (#41412) 2026-07-03 18:25:40 +08:00
user_api_key_spec.rb DEV: Apply syntax_tree formatting to spec/* 2023-01-09 11:49:28 +00:00
user_archived_message_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
user_associated_group_spec.rb FIX: Do not remove user from group with no association inadvertently [backport 2026.1] (#39925) 2026-05-12 16:48:56 +01:00
user_auth_token_spec.rb SECURITY: Bind shared session key to auth token and enforce user gates [backport 2026.1] (#41691) 2026-07-14 15:48:25 +08:00
user_avatar_spec.rb DEV: ensure rebaking works even when some users have inconsistent data (#30261) 2024-12-16 19:48:25 +08:00
user_badge_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
user_bookmark_list_spec.rb DEV: Allow fab! without block (#24314) 2023-11-09 16:47:59 -06:00
user_custom_field_spec.rb FIX: Searchable user fields do not always have an integer name (#30223) 2024-12-17 11:06:19 +11:00
user_email_spec.rb FIX: allow users with normalized emails to change emails and remove + / . (#37133) 2026-01-16 07:36:58 +11:00
user_export_spec.rb FEATURE: Allow admins to export users (#30918) 2025-01-24 08:13:25 +11:00
user_field_spec.rb FEATURE: Implement new required options in admin user fields UI (#27079) 2024-05-23 19:18:25 +08:00
user_history_spec.rb SECURITY: Restrict staff action logs visibility for moderators 2026-01-28 17:11:14 +00:00
user_notification_schedule_spec.rb DEV: Allow fab! without block (#24314) 2023-11-09 16:47:59 -06:00
user_option_spec.rb FEATURE: Convert watched_precedence_over_muted to default site setting (#35671) 2025-10-30 10:04:18 +10:00
user_password_spec.rb FIX: setting new password should reset password_expired_at (#29296) 2024-10-21 07:24:43 +08:00
user_profile_spec.rb DEV: Allow fab! without block (#24314) 2023-11-09 16:47:59 -06:00
user_profile_view_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
user_search_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
user_second_factor_spec.rb DEV: Allow fab! without block (#24314) 2023-11-09 16:47:59 -06:00
user_security_key_spec.rb DEV: Allow fab! without block (#24314) 2023-11-09 16:47:59 -06:00
user_spec.rb SECURITY: Signup-time primary_group_id assignment grants whisperer access [backport 2026.1] 2026-06-30 16:27:06 +02:00
user_stat_spec.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
user_status_spec.rb DEV: Allow fab! without block (#24314) 2023-11-09 16:47:59 -06:00
user_summary_spec.rb SECURITY: Replying to a whisper lets non-whisperers create staff-only whisper posts [backport 2026.1] 2026-05-19 00:26:55 +01:00
user_visit_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
username_validator_spec.rb FEATURE: Add plugin hook for extra username validations (#35522) 2025-10-27 11:03:42 -03:00
watched_word_group_spec.rb SECURITY: limit the number of characters in watched word replacements. 2024-07-15 19:25:17 +08:00
watched_word_spec.rb SECURITY: limit the number of characters in watched word replacements. 2024-07-15 19:25:17 +08:00
web_crawler_request_spec.rb DEV: stop leaking data into tables during test (#21403) 2023-05-06 07:15:33 +10:00
web_hook_event_spec.rb DEV: Apply syntax_tree formatting to spec/* 2023-01-09 11:49:28 +00:00
web_hook_event_type_spec.rb Add user_anonymized webhook event (#36208) 2025-11-25 07:43:16 -08:00
web_hook_events_daily_aggregate_spec.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
web_hook_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00