Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-09 21:45:25 +08:00
Code Packages Activity Actions
discourse/plugins/discourse-data-explorer/spec/requests
History
Exact
Bannon Tanner f9f6863056
 SECURITY: Group report details expose raw Data Explorer SQL to non-admin group members [backport 2026.1] (#40951) 
Backport of #40919 to release/2026.1.

---

## Summary

Prevent the exposure of raw Data Explorer SQL to non-admin group members
when viewing report details. The sql attribute is now correctly gated to
administrators within the query details serializer.

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/1290
- Affected file:
https://github.com/discourse/discourse/blob/main/plugins/discourse-data-explorer/app/serializers/discourse_data_explorer/query_details_serializer.rb

---

🤖 Auto-generated from the patch diff via Patch Triage. Review carefully
before merging.

Co-authored-by: discourse-patch-triage
<272280883+discourse-patch-triage[bot]@users.noreply.github.com>
2026-06-16 14:28:31 -05:00
..
group_spec.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
query_controller_spec.rb SECURITY: Group report details expose raw Data Explorer SQL to non-admin group members [backport 2026.1] (#40951) 2026-06-16 14:28:31 -05:00