Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-11 01:57:29 +08:00
Code Packages Activity Actions
discourse/app
History
Exact
discourse-patch-triage[bot] 2727e4d7db
 SECURITY: detailed_404 Security Setting Bypassed [backport 2026.1] (#41587) 
Backport of #41549 to release/2026.1.

---

## Summary

Prevent information disclosure of topic existence by ensuring secondary
topic endpoints respect the 'detailed_404' security setting. The patch
implements a normalization handler for several TopicsController
actions—including post retrieval and notification updates—to return a
consistent 404 status code for inaccessible topics when the setting is
disabled.

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/1384

Co-authored-by: discourse-patch-triage
<272280883+discourse-patch-triage[bot]@users.noreply.github.com>

Co-authored-by: Isaac Janzen <50783505+janzenisaac@users.noreply.github.com>
2026-07-09 11:27:42 -05:00
..
assets UX: Improve post stream scrolling stability and layout control [backport 2026.1] (#38318) 2026-03-06 10:06:47 -06:00
controllers SECURITY: detailed_404 Security Setting Bypassed [backport 2026.1] (#41587) 2026-07-09 11:27:42 -05:00
helpers UX: add preview to email templates (#36657) 2026-01-08 11:33:53 +04:00
jobs SECURITY: Authorize secure-upload hotlink downloads against post user [backport 2026.1] 2026-06-30 16:27:06 +02:00
mailers UX: improve sender name in emails (#36974) 2026-01-06 15:41:01 +04:00
models SECURITY: Restrict user action removal messages [backport 2026.1] (#41412) 2026-07-03 18:25:40 +08:00
queries/reports FEATURE: Add admin-only reports and centralize report visibility logic 2026-01-28 17:11:14 +00:00
serializers SECURITY: Reviewable conversations expose post-voting flag PM excerpts to category moderators outside the PM [backport 2026.1] (#41531) 2026-07-07 15:37:32 -05:00
services SECURITY: Regular users can route multipart uploads into the admin backup store [backport 2026.1] 2026-06-30 16:27:06 +02:00
views FIX: Strip HTML from category og:description meta tag (#37322) 2026-01-27 18:16:35 +11:00