Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-08 17:53:55 +08:00
Code Packages Activity Actions
discourse/spec/serializers
History
Exact
discoursebot 46b3bb2bc5
 SECURITY: /directory_items leaks restricted user-field values [backport 2026.1] (#41485) 
Backport of #41476 to release/2026.1.

---

## Summary

Prevent the exposure of restricted user-field values in the
`/directory_items.json` endpoint by enforcing profile visibility checks.
The directory item serializer now correctly respects site-wide profile
privacy settings and individual user profile visibility preferences.

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/1401

Co-authored-by: discourse-patch-triage
<272280883+discourse-patch-triage[bot]@users.noreply.github.com>

Co-authored-by: Isaac Janzen <50783505+janzenisaac@users.noreply.github.com>
2026-07-06 14:26:20 -05:00
..
concerns FEATURE: Prevent silenced users from liking and using reactions (#37040) 2026-01-13 13:59:57 +01:00
about_serializer_spec.rb DEV: More targeted cleanup in plugin registry specs (#31333) 2025-02-14 10:28:29 -05:00
admin_detailed_user_serializer_spec.rb SECURITY: AdminDetailedUserSerializer#latest_export leaking user exports 2026-01-28 17:11:14 +00:00
admin_plugin_serializer_spec.rb FIX: Plugin JS failing to load would break admin interface (#29139) 2024-10-11 09:26:10 +10:00
admin_user_action_serializer_spec.rb
admin_user_list_serializer_spec.rb FEATURE: Add bulk destroy to admin users list (#29744) 2024-11-25 11:13:35 +03:00
auth_provider_serializer_spec.rb DEV: Add capability to pass an icon setting into auth provider registration (#34584) 2025-08-28 09:14:36 -05:00
basic_group_serializer_spec.rb DEV: Remove full group refreshes from tests (#25414) 2024-01-25 14:28:26 +08:00
basic_group_user_serializer_spec.rb
basic_post_serializer_spec.rb FEATURE: Serve localized content in the site's default locale when user's language is unsupported (#36160) 2025-11-21 17:19:04 +08:00
basic_reviewable_flagged_post_serializer_spec.rb
basic_reviewable_queued_post_serializer_spec.rb
basic_reviewable_serializer_spec.rb
basic_reviewable_user_serializer_spec.rb
basic_topic_serializer_spec.rb FEATURE: Serve localized content in the site's default locale when user's language is unsupported (#36160) 2025-11-21 17:19:04 +08:00
basic_user_serializer_spec.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
category_detailed_serializer_spec.rb
category_serializer_spec.rb FIX: Use group IDs instead of names for "everyone" group checks (#36656) 2025-12-12 15:46:07 +01:00
category_upload_serializer_spec.rb
color_scheme_serializer_spec.rb FIX: Allow creating new color palettes based on custom palettes (#34351) 2025-08-20 11:58:40 +08:00
component_index_serializer_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
current_user_serializer_spec.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
detailed_user_badge_serializer_spec.rb
directory_item_serializer_spec.rb SECURITY: /directory_items leaks restricted user-field values [backport 2026.1] (#41485) 2026-07-06 14:26:20 -05:00
emoji_serializer_spec.rb FEATURE - Add username column to custom emoji table (#29522) 2024-11-01 10:32:59 -05:00
flag_serializer_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
flagged_user_serializer_spec.rb SECURITY: Hide IP from flagged regular users 2026-03-19 15:46:24 +00:00
found_user_serializer_spec.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
group_show_serializer_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
group_user_serializer_spec.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
group_user_with_custom_fields_serializer_spec.rb FEATURE: Hide user status when user is hiding public profile and presence (#24300) 2024-02-26 17:40:48 +04:00
incoming_email_details_serializer_spec.rb FIX: Remove error section when viewing details for received emails (#35228) 2025-10-07 16:25:11 +08:00
incoming_email_serializer_spec.rb FIX: Remove error section when viewing details for received emails (#35228) 2025-10-07 16:25:11 +08:00
invite_serializer_spec.rb SECURITY: Prevent expired invite details from leaking [backport 2026.1] (#41193) 2026-06-25 22:02:07 +08:00
listable_topic_serializer_spec.rb DEV: Remove 'experimental' prefix from settings (#33233) 2025-06-19 12:23:42 +08:00
new_post_result_serializer_spec.rb
notification_serializer_spec.rb FIX: Notifications may not have topics (#36143) 2025-11-21 01:50:31 +08:00
pending_post_serializer_spec.rb
post_action_type_serializer_spec.rb FIX: Return properly interpolated translations for flag types 2024-07-30 18:30:57 +02:00
post_item_excerpt_spec.rb FIX: draft excerpts with deeply nested html (#35678) 2025-11-03 13:37:15 +04:00
post_localization_serializer_spec.rb FEATURE: Add translations to posts (#32564) 2025-05-08 10:40:36 -07:00
post_revision_serializer_spec.rb FEATURE: Localize language names (#33790) 2025-07-29 11:48:45 +08:00
post_serializer_spec.rb FEATURE: Prevent silenced users from liking and using reactions (#37040) 2026-01-13 13:59:57 +01:00
poster_serializer_spec.rb
remote_theme_serializer_spec.rb FIX: Hide broken theme about/license URLs (#29930) 2024-11-26 13:53:10 +10:00
reviewable_claimed_topic_serializer_spec.rb FEATURE: Sync Reviewable Status (#31901) 2025-03-24 14:27:18 +11:00
reviewable_flagged_post_serializer_spec.rb
reviewable_note_serializer_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
reviewable_queued_post_serializer_spec.rb SECURITY: Restrict raw email in queued post payloads [backport 2026.1] 2026-05-19 00:26:55 +01:00
reviewable_score_serializer_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
reviewable_serializer_spec.rb FIX: Keep reviewable pending when penalized user deletes flagged post (#36873) 2026-01-19 10:37:19 +01:00
reviewable_user_serializer_spec.rb FEATURE: Add IP lookup to review interface (#36130) 2025-11-20 12:23:03 +08:00
single_sign_on_record_serializer_spec.rb
site_serializer_spec.rb FIX: Allow creating new color palettes based on custom palettes (#34351) 2025-08-20 11:58:40 +08:00
suggested_topic_serializer_spec.rb FIX: Add op_like_count to suggested topics serializer (#37164) 2026-01-16 11:20:51 +03:00
tag_group_serializer_spec.rb FIX: ensure GroupChooser works with localized group names (#30593) 2025-01-13 11:29:04 +01:00
tag_serializer_spec.rb
theme_index_serializer_spec.rb FEATURE: enhance screenshot support for themes with dark/light modes (#36422) 2025-12-10 11:23:21 +10:00
theme_objects_setting_metadata_serializer_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
theme_serializer_spec.rb FEATURE: enhance screenshot support for themes with dark/light modes (#36422) 2025-12-10 11:23:21 +10:00
theme_settings_serializer_spec.rb DEV: Allow theme setting enum choices to be translated (#37096) 2026-01-14 11:18:39 +01:00
topic_link_serializer_spec.rb FIX: Filter orphaned TopicLinks and normalize http URLs to https (#37098) 2026-01-15 12:12:34 +08:00
topic_list_item_serializer_spec.rb FIX: Inconsistent op_like_count serialization with serialize_topic_op_likes_data (#36950) 2026-01-07 19:12:22 +01:00
topic_list_serializer_spec.rb FIX: Navigating via topic filters should not untranslate a category name (#35211) 2025-10-06 23:31:06 +08:00
topic_tracking_state_item_serializer_spec.rb
topic_tracking_state_serializer_spec.rb
topic_view_details_serializer_spec.rb FIX: DeleteReplies should use the guardian instead of checking for staff (#35443) 2025-10-16 18:26:41 +02:00
topic_view_posts_serializer_spec.rb
topic_view_serializer_spec.rb FIX: Filter orphaned TopicLinks and normalize http URLs to https (#37098) 2026-01-15 12:12:34 +08:00
upload_serializer_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
user_auth_token_serializer_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
user_badge_serializer_spec.rb
user_bookmark_list_serializer_spec.rb DEV: More targeted cleanup in plugin registry specs (#31333) 2025-02-14 10:28:29 -05:00
user_card_serializer_spec.rb FEATURE: Prevent silenced users from liking and using reactions (#37040) 2026-01-13 13:59:57 +01:00
user_export_serializer_spec.rb FIX: User profile not loading with an empty export (#31290) 2025-02-11 16:18:06 -07:00
user_notification_total_serializer_spec.rb DEV: Dedicated route for current user notification counts (#26106) 2024-03-15 12:08:37 -04:00
user_post_bookmark_serializer_spec.rb
user_serializer_spec.rb SECURITY: Subscription contributors expose full user profile fields to anonymous viewers [backport 2026.1] (#40894) 2026-06-15 10:24:34 -05:00
user_status_serializer_spec.rb
user_summary_serializer_spec.rb FEATURE: allow disabling user activity tab for non admin users (#25540) 2024-02-05 14:30:36 +05:30
user_with_custom_fields_serializer_spec.rb FEATURE: Hide user status when user is hiding public profile and presence (#24300) 2024-02-26 17:40:48 +04:00
web_hook_post_serializer_spec.rb DEV: Post localization improvements (#32869) 2025-05-27 08:49:53 -07:00
web_hook_topic_view_serializer_spec.rb
web_hook_user_serializer_spec.rb DEV: use new 'ignore allowed groups' site settings (#27670) 2024-07-04 19:27:26 +02:00
wizard_serializer_spec.rb UX: One step wizard (#36082) 2025-11-25 13:35:32 -05:00