Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-07 13:19:19 +08:00
Code Packages Activity Actions
discourse/spec/requests
History
Exact
discourse-patch-triage[bot] 66542af04e
 SECURITY: DoS vis uncapped Bulk Topic Actions [backport 2026.1] (#42004) 
Backport of #42001 to release/2026.1.

---

## Summary

Limit and deduplicate topic_ids for bulk actions.

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/1477

Co-authored-by: discourse-patch-triage
<272280883+discourse-patch-triage[bot]@users.noreply.github.com>

Co-authored-by: David Taylor <david@taylorhq.com>
2026-07-23 23:07:07 +01:00
..
admin SECURITY: block cross-site backup traversal in multisite local storage [backport 2026.1] 2026-05-19 00:26:55 +01:00
api SECURITY: Respect group member visibility for counts [backport 2026.1] (#41420) 2026-07-06 12:47:49 +08:00
examples
about_controller_spec.rb
application_controller_spec.rb SECURITY: Bind shared session key to auth token and enforce user gates [backport 2026.1] (#41691) 2026-07-14 15:48:25 +08:00
associate_accounts_controller_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
badges_controller_spec.rb
bookmarks_controller_spec.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
categories_controller_spec.rb SECURITY: Stale featured rows expose unlisted topic content [backport 2026.1] (#41813) 2026-07-17 09:40:52 -05:00
clicks_controller_spec.rb SECURITY: Missing visibility check in click tracking endpoint [backport 2026.1] (#41148) 2026-06-24 15:47:50 +10:00
composer_controller_spec.rb SECURITY: Respect group member visibility for counts [backport 2026.1] (#41420) 2026-07-06 12:47:49 +08:00
composer_messages_controller_spec.rb SECURITY: Whisper metadata disclosure via stale TopicLinks [backport 2026.1] (#41145) 2026-06-24 15:51:51 +10:00
crawler_hreflang_spec.rb FEATURE: Append locale to links in crawler view if present (#34466) 2025-08-22 08:46:33 +08:00
csp_reports_controller_spec.rb
default_headers_spec.rb DEV: Disallow the use of Rails.logger= in RSpec tests (#31920) 2025-03-21 08:48:38 +08:00
dev_mode_controller_spec.rb DEV: Add /dev-mode endpoint for MiniProfiler auth cookie (#37027) 2026-01-12 10:01:20 +08:00
directory_columns_controller_spec.rb
directory_items_controller_spec.rb SECURITY: Private UserField value disclosure via directory_items order sort side-channel [backport 2026.1] (#41601) 2026-07-09 21:53:32 -05:00
discourse_id_controller_spec.rb DEV: Add validator for enable_discourse_id setting (#33710) 2025-07-21 08:18:36 -04:00
do_not_disturb_controller_spec.rb
drafts_controller_spec.rb DEV: Better protection for drafts 2026-01-28 17:11:14 +00:00
edit_directory_columns_controller_spec.rb
email_controller_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
embed_controller_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
emojis_controller_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
exceptions_controller_spec.rb FIX: Respect forced color mode for logo on server-rendered pages (#37032) 2026-01-09 11:33:06 +01:00
export_csv_controller_spec.rb SECURITY: Prevent moderators from exporting admin-only reports via CSV [backport 2026.1] 2026-03-31 15:12:50 +01:00
extra_locales_controller_spec.rb DEV: Refactor locale bundle loading (#37114) 2026-01-16 11:45:14 +00:00
finish_installation_controller_spec.rb DEV: Allow new instances to be set up directly with Discourse ID (#36731) 2025-12-23 12:13:36 -05:00
form_templates_controller_spec.rb SECURITY: Scope form template endpoints to accessible categories [backport 2026.1] 2026-05-19 00:26:55 +01:00
forums_controller_spec.rb FIX: improve "read only" modes (#33521) 2025-07-10 09:08:00 +02:00
groups_controller_spec.rb SECURITY: mentionable/messageable endpoints bypassing visibility controls [backport 2026.1] (#41523) 2026-07-07 14:38:45 -05:00
hashtags_controller_spec.rb DEV: add tag hashtag data source style type (#33289) 2025-06-20 18:08:47 +04:00
highlightjs_controller_spec.rb DEV: Simplify CORS logic for public asset routes (#33106) 2025-06-09 08:58:27 +01:00
home_page_controller_spec.rb DEV: Add site description to crawler homepage view (#32845) 2025-05-22 08:33:59 +10:00
inline_onebox_controller_spec.rb SECURITY: Check topic visibility in Oneboxer even when categories match [backport 2026.1] 2026-03-31 15:12:50 +01:00
invites_controller_spec.rb SECURITY: Gate staged user fields on email verification [backport 2026.1] 2026-03-31 15:12:50 +01:00
list_controller_spec.rb SECURITY: Harden ListController top period query against SQL injection [backport 2026.1] (#41723) 2026-07-15 12:18:25 +08:00
metadata_controller_spec.rb SECURITY: Error responses missing Cache-Control header 2025-10-28 14:40:41 +08:00
net_http_header_spec.rb DEV: Add a user agent to all HTTP requests that Discourse makes. (#31555) 2025-03-03 16:32:25 +11:00
net_http_timeout_spec.rb
noscript_escape_spec.rb
notifications_controller_spec.rb FIX: Hide badge notifications for disabled badges or when badges are disabled (#36987) 2026-01-07 15:28:43 +08:00
offline_controller_spec.rb
omniauth_callbacks_controller_spec.rb FIX: Leave username blank during OAuth signup when no valid suggestion exists (#36830) 2026-01-08 11:02:35 +01:00
onebox_controller_spec.rb SECURITY: prevent hidden profile data leak via user onebox 2026-03-19 15:46:24 +00:00
permalinks_controller_spec.rb SECURITY: prevent permalink redirects from leaking restricted slugs 2026-01-28 17:11:14 +00:00
post_action_users_controller_spec.rb SECURITY: hide total_rows for restricted post action types 2026-03-19 15:46:24 +00:00
post_actions_controller_spec.rb SECURITY: fix is_warning type coercion bypass in PostActionsController 2026-03-19 15:46:24 +00:00
post_localizations_controller_spec.rb FEATURE: Allow post authors to localize their own posts (#36178) 2025-11-25 11:02:22 +08:00
post_readers_controller_spec.rb SECURITY: Missing post-level authorization allows whisper metadata disclosure [backport 2026.1] 2026-03-31 15:12:50 +01:00
posts_controller_spec.rb SECURITY: PostsController#raw_email leaks raw emails of inaccessible to mods [backport 2026.1] (#41966) 2026-07-23 16:37:00 +10:00
presence_controller_spec.rb
published_pages_controller_spec.rb DEV: Deprecate the assignment of nil to site settings (#36093) 2025-12-01 15:04:23 +08:00
push_notification_controller_spec.rb
qunit_controller_spec.rb DEV: Rename theme-transpiler to asset-processor (#35498) 2025-10-20 14:16:46 +01:00
reviewable_claimed_topics_controller_spec.rb DEV: Update spec expectations 2026-05-19 00:26:55 +01:00
reviewable_notes_controller_spec.rb SECURITY: scope reviewable notes to user-visible reviewables 2026-02-26 12:24:37 +00:00
reviewables_controller_spec.rb SECURITY: Reviewable conversations expose post-voting flag PM excerpts to category moderators outside the PM [backport 2026.1] (#41531) 2026-07-07 15:37:32 -05:00
robots_txt_controller_spec.rb
safe_mode_controller_spec.rb DEV: Compile 'common' CSS into own assets (#31416) 2025-05-01 10:44:49 +01:00
search_controller_spec.rb SECURITY: Apply category tag visibility to full-text search [backport 2026.1] (#41673) 2026-07-13 15:16:49 -03:00
session_controller_spec.rb DEV: Finish renaming secure_session to server_session 2025-09-23 10:35:02 +02:00
sidebar_sections_controller_spec.rb FIX: on edit, ensure community section remains at top of sidebar (#36597) 2025-12-10 12:26:35 -05:00
similar_topics_controller_spec.rb
site_controller_spec.rb DEV: Introduce stylelint (#29852) 2025-01-20 15:27:42 +00:00
sitemap_controller_spec.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
slugs_controller_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
static_controller_spec.rb SECURITY: Validate sso_destination_url cookie to prevent open redirect [backport 2026.1] 2026-03-31 15:12:50 +01:00
steps_controller_spec.rb UX: One step wizard (#36082) 2025-11-25 13:35:32 -05:00
stylesheets_controller_spec.rb
svg_sprite_controller_spec.rb DEV: enable raise_error in test envs for deprecated icons in svg_sprite.rb (#30980) 2025-02-04 21:21:20 +08:00
tag_groups_controller_spec.rb DEV: Add tests for parent_tag_name param in TagGroupsController (#37076) 2026-01-13 14:46:47 +08:00
tag_localizations_controller_spec.rb FEATURE: Introduce tag localizations with API, without UI yet (#36754) 2025-12-18 18:25:58 +08:00
tags_controller_spec.rb SECURITY: Don't leak restricted tag group names via tag info [backport 2026.1] 2026-05-19 00:26:55 +01:00
theme_javascripts_controller_spec.rb DEV: Use rollup for theme JS compilation (#33103) 2025-07-25 12:02:29 +01:00
topic_localizations_controller_spec.rb UX: Use inline title editor instead of composer when editing translation (#36847) 2025-12-24 00:56:36 +08:00
topic_view_stats_controller_spec.rb
topics_controller_spec.rb SECURITY: DoS vis uncapped Bulk Topic Actions [backport 2026.1] (#42004) 2026-07-23 23:07:07 +01:00
uploads_controller_multisite_spec.rb
uploads_controller_spec.rb SECURITY: Regular users can route multipart uploads into the admin backup store [backport 2026.1] 2026-06-30 16:27:06 +02:00
user_actions_controller_spec.rb SECURITY: Enforce Guardian checks in UserActionsController#show 2026-03-19 15:46:24 +00:00
user_api_key_clients_controller_spec.rb Add user api key client rate limit settings (#30402) 2024-12-30 11:10:48 -05:00
user_api_keys_controller_spec.rb SECURITY: Validate auth_redirect in UserApiKeysController#new to prevent open redirect phishing 2026-03-19 15:46:24 +00:00
user_avatars_controller_spec.rb SECURITY: Improve SVG sanitization [backport 2026.1] 2026-06-30 16:27:06 +02:00
user_badges_controller_spec.rb SECURITY: Prevent badge lookup from exposing hidden profiles [backport 2026.1] (#41163) 2026-06-25 14:11:30 +08:00
user_status_controller_spec.rb FEATURE: Prevent silenced users from liking and using reactions (#37040) 2026-01-13 13:59:57 +01:00
users_controller_spec.rb SECURITY: An unauthorized user can delete emails of other users including Admins [backport 2026.1] (#41930) 2026-07-22 12:17:40 -05:00
users_email_controller_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
webhooks_controller_spec.rb SECURITY: Prevent any signed AWS SNS TopicARN from being accepted via webhooks [backport 2026.1] 2026-06-30 16:27:06 +02:00
wizard_controller_spec.rb