| .. |
|
admin
|
SECURITY: block cross-site backup traversal in multisite local storage [backport 2026.1]
|
2026-05-19 00:26:55 +01:00 |
|
users
|
FIX: Delete destination_url cookie when it's used to set origin param during redirect to social auth (#36194)
|
2025-11-25 09:15:03 -06:00 |
|
about_controller.rb
|
DEV: Revert guardian changes (#24742)
|
2023-12-06 16:37:32 +10:00 |
|
application_controller.rb
|
DEV: Add /dev-mode endpoint for MiniProfiler auth cookie (#37027)
|
2026-01-12 10:01:20 +08:00 |
|
associated_groups_controller.rb
|
|
|
|
badges_controller.rb
|
|
|
|
bookmarks_controller.rb
|
DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073)
|
2025-10-06 16:11:01 +02:00 |
|
bootstrap_controller.rb
|
DEV: Use Rails to render site-settings for qunit tests (#37105)
|
2026-01-14 12:25:12 +00:00 |
|
categories_controller.rb
|
SECURITY: Stop exposing hidden tag names through category serializers [backport 2026.1]
|
2026-07-28 17:00:54 +02:00 |
|
clicks_controller.rb
|
SECURITY: Missing visibility check in click tracking endpoint [backport 2026.1] (#41148)
|
2026-06-24 15:47:50 +10:00 |
|
composer_controller.rb
|
SECURITY: Respect group member visibility for counts [backport 2026.1] (#41420)
|
2026-07-06 12:47:49 +08:00 |
|
composer_messages_controller.rb
|
SECURITY: Whisper metadata disclosure via stale TopicLinks [backport 2026.1] (#41145)
|
2026-06-24 15:51:51 +10:00 |
|
csp_reports_controller.rb
|
|
|
|
dev_mode_controller.rb
|
DEV: Add /dev-mode endpoint for MiniProfiler auth cookie (#37027)
|
2026-01-12 10:01:20 +08:00 |
|
directory_columns_controller.rb
|
|
|
|
directory_items_controller.rb
|
SECURITY: Private UserField value disclosure via directory_items order sort side-channel [backport 2026.1] (#41601)
|
2026-07-09 21:53:32 -05:00 |
|
do_not_disturb_controller.rb
|
|
|
|
drafts_controller.rb
|
DEV: Better protection for drafts
|
2026-01-28 17:11:14 +00:00 |
|
edit_directory_columns_controller.rb
|
|
|
|
email_controller.rb
|
FEATURE: implement RFC 8058 for email unsubscribe (#33392)
|
2025-07-01 11:01:13 +10:00 |
|
embed_controller.rb
|
DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073)
|
2025-10-06 16:11:01 +02:00 |
|
emojis_controller.rb
|
DEV: discourse-emojis gem (#31408)
|
2025-03-03 13:09:08 +01:00 |
|
exceptions_controller.rb
|
|
|
|
export_csv_controller.rb
|
SECURITY: Prevent moderators from exporting admin-only reports via CSV [backport 2026.1]
|
2026-03-31 15:12:50 +01:00 |
|
extra_locales_controller.rb
|
DEV: Refactor locale bundle loading (#37114)
|
2026-01-16 11:45:14 +00:00 |
|
finish_installation_controller.rb
|
FIX: Redirect to wizard when setting up new instance using Discourse ID (#36993)
|
2026-01-07 10:19:17 -05:00 |
|
form_templates_controller.rb
|
SECURITY: Scope form template endpoints to accessible categories [backport 2026.1]
|
2026-05-19 00:26:55 +01:00 |
|
forums_controller.rb
|
DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073)
|
2025-10-06 16:11:01 +02:00 |
|
groups_controller.rb
|
SECURITY: mentionable/messageable endpoints bypassing visibility controls [backport 2026.1] (#41523)
|
2026-07-07 14:38:45 -05:00 |
|
hashtags_controller.rb
|
FEATURE: Async load of category and chat hashtags (#25526)
|
2024-02-12 12:07:14 +02:00 |
|
highlight_js_controller.rb
|
FEATURE: User fields required for existing users - Part 2 (#27172)
|
2024-06-25 19:32:18 +08:00 |
|
home_page_controller.rb
|
DEV: Show login-required splash in root route (take 2) (#32629)
|
2025-05-14 11:25:43 -04:00 |
|
inline_onebox_controller.rb
|
DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073)
|
2025-10-06 16:11:01 +02:00 |
|
invites_controller.rb
|
SECURITY: Gate staged user fields on email verification [backport 2026.1]
|
2026-03-31 15:12:50 +01:00 |
|
list_controller.rb
|
SECURITY: Harden ListController top period query against SQL injection [backport 2026.1] (#41723)
|
2026-07-15 12:18:25 +08:00 |
|
metadata_controller.rb
|
DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073)
|
2025-10-06 16:11:01 +02:00 |
|
new_invite_controller.rb
|
FEATURE: Add invite link to the sidebar (#29448)
|
2024-10-30 05:31:14 +03:00 |
|
new_topic_controller.rb
|
|
|
|
notifications_controller.rb
|
FIX: Hide badge notifications for disabled badges or when badges are disabled (#36987)
|
2026-01-07 15:28:43 +08:00 |
|
offline_controller.rb
|
FEATURE: User fields required for existing users - Part 2 (#27172)
|
2024-06-25 19:32:18 +08:00 |
|
onebox_controller.rb
|
DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073)
|
2025-10-06 16:11:01 +02:00 |
|
pageview_controller.rb
|
FEATURE: User fields required for existing users - Part 2 (#27172)
|
2024-06-25 19:32:18 +08:00 |
|
permalinks_controller.rb
|
SECURITY: prevent permalink redirects from leaking restricted slugs
|
2026-01-28 17:11:14 +00:00 |
|
post_action_users_controller.rb
|
SECURITY: hide total_rows for restricted post action types
|
2026-03-19 15:46:24 +00:00 |
|
post_actions_controller.rb
|
SECURITY: fix is_warning type coercion bypass in PostActionsController
|
2026-03-19 15:46:24 +00:00 |
|
post_localizations_controller.rb
|
FIX: Also check if user can see post or topic prior to letting them localize it (#36749)
|
2025-12-18 02:12:58 +08:00 |
|
post_readers_controller.rb
|
SECURITY: Missing post-level authorization allows whisper metadata disclosure [backport 2026.1]
|
2026-03-31 15:12:50 +01:00 |
|
posts_controller.rb
|
SECURITY: PostsController#raw_email leaks raw emails of inaccessible to mods [backport 2026.1] (#41966)
|
2026-07-23 16:37:00 +10:00 |
|
presence_controller.rb
|
FIX: improve "read only" modes (#33521)
|
2025-07-10 09:08:00 +02:00 |
|
published_pages_controller.rb
|
FEATURE: User fields required for existing users - Part 2 (#27172)
|
2024-06-25 19:32:18 +08:00 |
|
push_notification_controller.rb
|
|
|
|
qunit_controller.rb
|
DEV: Only load specific plugin bundles during qunit test (#33678)
|
2025-07-21 21:00:48 +01:00 |
|
reviewable_claimed_topics_controller.rb
|
FIX: Only log unclaimed history when topic was claimed (#36949)
|
2026-01-06 14:52:55 +08:00 |
|
reviewable_notes_controller.rb
|
SECURITY: scope reviewable notes to user-visible reviewables
|
2026-02-26 12:24:37 +00:00 |
|
reviewables_controller.rb
|
SECURITY: XSS in review queue via highlightWatchedWords
|
2026-03-19 15:46:24 +00:00 |
|
robots_txt_controller.rb
|
DEV: Update link to comment in robots.txt as 'allow' is allowed (#33227)
|
2025-06-18 13:30:26 +08:00 |
|
safe_mode_controller.rb
|
FIX: Set X-Robots-Tag header to prevent indexing of /safe-mode (#32329)
|
2025-04-16 16:51:32 +10:00 |
|
search_controller.rb
|
FIX: stop delegating AI search to filter (#36968)
|
2026-01-07 07:34:05 +11:00 |
|
session_controller.rb
|
FIX: invites to private topic when using discourse connect (#35303)
|
2025-10-10 07:32:40 +02:00 |
|
sidebar_sections_controller.rb
|
FIX: on edit, ensure community section remains at top of sidebar (#36597)
|
2025-12-10 12:26:35 -05:00 |
|
similar_topics_controller.rb
|
|
|
|
site_controller.rb
|
SECURITY: Preload data only when rendering application layout
|
2025-02-04 13:32:30 -03:00 |
|
sitemap_controller.rb
|
|
|
|
slugs_controller.rb
|
|
|
|
static_controller.rb
|
SECURITY: Validate sso_destination_url cookie to prevent open redirect [backport 2026.1]
|
2026-03-31 15:12:50 +01:00 |
|
steps_controller.rb
|
UX: One step wizard (#36082)
|
2025-11-25 13:35:32 -05:00 |
|
stylesheets_controller.rb
|
DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073)
|
2025-10-06 16:11:01 +02:00 |
|
svg_sprite_controller.rb
|
DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073)
|
2025-10-06 16:11:01 +02:00 |
|
tag_groups_controller.rb
|
FIX: Use the max_tag_search_results setting as the default limit for tag groups search (#33485)
|
2025-07-09 05:13:19 +03:00 |
|
tag_localizations_controller.rb
|
FEATURE: Introduce tag localizations with API, without UI yet (#36754)
|
2025-12-18 18:25:58 +08:00 |
|
tag_param_limit.rb
|
SECURITY: Reject too many tags during post creation [backport 2026.1] (#41400)
|
2026-07-03 14:54:15 +08:00 |
|
tags_controller.rb
|
SECURITY: Enforce hidden tag visibility in fetch_tag [backport 2026.1]
|
2026-03-31 15:12:50 +01:00 |
|
test_requests_controller.rb
|
DEV: Add a user agent to all HTTP requests that Discourse makes. (#31555)
|
2025-03-03 16:32:25 +11:00 |
|
theme_javascripts_controller.rb
|
DEV: Manually fix Rails/UnusedRenderContent offenses (#34418)
|
2025-08-22 11:42:12 +02:00 |
|
topic_localizations_controller.rb
|
UX: Use inline title editor instead of composer when editing translation (#36847)
|
2025-12-24 00:56:36 +08:00 |
|
topic_view_stats_controller.rb
|
FEATURE: topic_view_stats table with daily fidelity (#27197)
|
2024-05-27 15:25:32 +10:00 |
|
topics_controller.rb
|
SECURITY: DoS vis uncapped Bulk Topic Actions [backport 2026.1] (#42004)
|
2026-07-23 23:07:07 +01:00 |
|
uploads_controller.rb
|
SECURITY: Download allowlist for uploaded files
|
2026-01-28 17:11:14 +00:00 |
|
user_actions_controller.rb
|
SECURITY: Enforce Guardian checks in UserActionsController#show
|
2026-03-19 15:46:24 +00:00 |
|
user_api_key_clients_controller.rb
|
Add user api key client rate limit settings (#30402)
|
2024-12-30 11:10:48 -05:00 |
|
user_api_keys_controller.rb
|
SECURITY: Validate auth_redirect in UserApiKeysController#new to prevent open redirect phishing
|
2026-03-19 15:46:24 +00:00 |
|
user_avatars_controller.rb
|
SECURITY: Improve SVG sanitization [backport 2026.1]
|
2026-06-30 16:27:06 +02:00 |
|
user_badges_controller.rb
|
SECURITY: Prevent badge lookup from exposing hidden profiles [backport 2026.1] (#41163)
|
2026-06-25 14:11:30 +08:00 |
|
user_status_controller.rb
|
|
|
|
users_controller.rb
|
SECURITY: An unauthorized user can delete emails of other users including Admins [backport 2026.1] (#41930)
|
2026-07-22 12:17:40 -05:00 |
|
users_email_controller.rb
|
DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073)
|
2025-10-06 16:11:01 +02:00 |
|
webhooks_controller.rb
|
SECURITY: Prevent any signed AWS SNS TopicARN from being accepted via webhooks [backport 2026.1]
|
2026-06-30 16:27:06 +02:00 |
|
wizard_controller.rb
|
|
|
