Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-06 13:08:40 +08:00
Code Packages Activity Actions
discourse/spec/services
History
Exact
discoursebot 23bdf21a35
 SECURITY: Stale featured rows expose unlisted topic content [backport 2026.1] (#41813) 
Backport of #41810 to release/2026.1.

---

## Summary

Prevent the exposure of unlisted topic metadata in the categories
response by enforcing live visibility checks on featured topics.
Additionally, the UserSilencer service now correctly removes featured
topic records when bulk-hiding topics from new users, ensuring stale
records do not bypass visibility constraints.

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/1427

Co-authored-by: discourse-patch-triage
<272280883+discourse-patch-triage[bot]@users.noreply.github.com>

Co-authored-by: Bannon Tanner <bannon@discourse.org>
2026-07-17 09:40:52 -05:00
..
admin_notices FIX: Dismissing admin notices fails with 422 when tracker has NULL target (#36878) 2025-12-29 16:32:12 +01:00
discourse_id FEATURE: Discourse ID setting page (#36316) 2025-12-11 16:04:09 +01:00
flags DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
notification/action FEATURE: Notify admins of upcoming changes and log events (#37003) 2026-01-21 12:45:54 +10:00
notifications FEATURE: Consolidate link notifications (#26567) 2024-04-09 11:53:37 -06:00
problem_check SECURITY: Prevent any signed AWS SNS TopicARN from being accepted via webhooks [backport 2026.1] 2026-06-30 16:27:06 +02:00
review DEV: Log Reviewable actions (#36076) 2025-11-20 13:41:40 +11:00
site_setting DEV: Allow specifying dependent settings in configuration (#36061) 2025-11-27 13:23:43 +08:00
tags FEATURE: create tags inline on the /tags route (#36645) 2025-12-16 11:25:14 -05:00
themes FIX: Add delete button to themes grid (#34606) 2025-08-29 10:09:23 +08:00
upcoming_changes FEATURE: Notify admins of upcoming changes and log events (#37003) 2026-01-21 12:45:54 +10:00
user SECURITY: Enforce edit permissions and audit trail in TriggerPostAction 2026-03-19 15:46:24 +00:00
video_conversion DEV: Add video conversion support for chat messages (#36275) 2025-12-01 12:34:56 -07:00
anonymous_shadow_creator_spec.rb UX: Improve naming for anonymous mode settings (#31832) 2025-03-21 04:54:06 +03:00
auto_silence_spec.rb FIX: Moderator notifications when new post auto-silences a user (#35403) 2025-10-15 16:07:56 +08:00
badge_granter_spec.rb FIX: Allow badges with SQL queries to be manually granted (#36866) 2026-01-09 13:58:09 +01:00
base_bookmarkable_spec.rb FIX: Show deleted bookmark reminders in user bookmarks menu (#25905) 2024-02-29 09:03:49 +10:00
category_hashtag_data_source_spec.rb UX: Show parent category name for category hashtags (#31188) 2025-02-05 12:31:50 +10:00
category_hierarchical_search_spec.rb FIX: Load categories for edit navigation menu modal in hierarchical order (#36927) 2026-01-07 14:03:52 +08:00
color_scheme_revisor_spec.rb FEATURE: Ability to set palettes as default on theme (#34480) 2025-08-27 09:09:34 +08:00
destroy_task_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
email_settings_exception_handler_spec.rb DEV: Remove IMAP support in Discourse (#37002) 2026-01-12 10:07:26 +10:00
email_settings_validator_spec.rb DEV: Remove IMAP support in Discourse (#37002) 2026-01-12 10:07:26 +10:00
email_style_updater_spec.rb
external_upload_manager_spec.rb SECURITY: Regular users can route multipart uploads into the admin backup store [backport 2026.1] 2026-06-30 16:27:06 +02:00
flag_sockpuppets_spec.rb
group_action_logger_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
group_mentions_updater_spec.rb
group_message_spec.rb FIX: crawler view with unicode usernames (#27051) 2024-05-16 17:11:24 +02:00
hashtag_autocomplete_service_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
heat_settings_updater_spec.rb
inline_uploads_multisite_spec.rb
inline_uploads_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
locale_normalizer_spec.rb FIX: Show localization for regionless locale if they exist (#33702) 2025-07-21 15:45:14 +08:00
notification_emailer_spec.rb FIX: Avoid sending user emails if @ mentioning a staged user in a topic (#26102) 2024-03-13 11:05:34 +08:00
post_action_notifier_spec.rb
post_alerter_spec.rb SECURITY: Replying to a whisper lets non-whisperers create staff-only whisper posts [backport 2026.1] 2026-05-19 00:26:55 +01:00
post_bookmarkable_spec.rb DEV: Remove unnecessary rails_helper requiring (#26364) 2024-03-26 11:32:01 +01:00
post_owner_changer_spec.rb SECURITY: Ensure moderator can see post/topic before allowing them to change owner 2026-01-28 17:11:14 +00:00
problem_check_spec.rb DEV: Clean up trackers with outdated targets (#35978) 2026-01-14 12:54:16 +01:00
push_notification_pusher_spec.rb DEV: Migrate from sprockets to propshaft for assets (#32475) 2025-04-30 08:59:32 +01:00
random_topic_selector_spec.rb
search_indexer_spec.rb FEATURE: Add full-text search for chat messages (#34704) 2025-10-22 11:30:35 +02:00
sidebar_site_settings_backfiller_spec.rb DEV: Hand-pick Rails/WhereNot autofixes (#35117) 2025-10-03 13:29:22 +02:00
site_settings_spec.rb DEV: Refactor and add missing tests for upload type in objects schema (#36285) 2025-11-28 04:02:23 +08:00
staff_action_logger_spec.rb FEATURE: Automatic promotion of upcoming changes (#36211) 2025-12-08 15:49:34 +10:00
tag_hashtag_data_source_spec.rb
theme_settings_migrations_runner_spec.rb FIX: Make getCategoryIdByName theme migration helper case insensitive (#26878) 2024-05-06 12:42:58 +08:00
themes_spec.rb DEV: Fix constant redefinition warnings when running specs (#29837) 2024-11-20 15:17:36 +11:00
topic_bookmarkable_spec.rb DEV: Remove unnecessary rails_helper requiring (#26364) 2024-03-26 11:32:01 +01:00
topic_status_updater_spec.rb FIX: Exclude unlisted topics from hot scores (#37312) 2026-01-27 13:46:57 +11:00
topic_timestamp_changer_spec.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
trust_level_granter_spec.rb
user_activator_spec.rb
user_anonymizer_spec.rb FIX: Only anonymize staff log fields that contain the username (#37242) 2026-01-27 17:39:21 +01:00
user_authenticator_spec.rb FIX: do not enforce 2fa when an account is created with OAuth (#28625) 2024-08-29 11:19:04 +10:00
user_destroyer_spec.rb FIX: UserDestroyer should unclaim any claimed reviewables. (#36277) 2025-11-27 13:54:48 +11:00
user_merger_spec.rb FIX: blocks post action merge for duplicated flags (#36265) 2025-11-26 16:17:57 -03:00
user_notification_schedule_processor_spec.rb
user_password_expirer_spec.rb DEV: Migrate user passwords data to UserPassword table (#28746) 2024-10-10 09:23:06 +08:00
user_silencer_spec.rb SECURITY: Stale featured rows expose unlisted topic content [backport 2026.1] (#41813) 2026-07-17 09:40:52 -05:00
user_stat_count_updater_spec.rb DEV: Don’t replace Rails logger in specs (#29721) 2024-11-13 08:47:39 +08:00
user_suspender_spec.rb SECURITY: Don't allow suspending staff users via other_user_ids param 2024-07-03 20:49:29 +08:00
user_updater_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
username_changer_spec.rb UX: improve quote title alignment, wrapping (#33796) 2025-07-23 16:21:55 -04:00
username_checker_service_spec.rb
wildcard_domain_checker_spec.rb
wildcard_url_checker_spec.rb
word_watcher_spec.rb FIX: silent failure when watched words contains invalid regex (#36132) 2025-11-25 21:56:33 +01:00