Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-05 15:18:34 +08:00
Code Packages Activity Actions
discourse/app
History
Exact
discoursebot d42085f16a
 SECURITY: DoS vis uncapped Bulk Topic Actions [backport 2026.5] (#42003) 
Backport of #42001 to release/2026.5.

---

## Summary

Limit and deduplicate topic_ids for bulk actions.

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/1477

Co-authored-by: discourse-patch-triage
<272280883+discourse-patch-triage[bot]@users.noreply.github.com>

Co-authored-by: David Taylor <david@taylorhq.com>
2026-07-23 23:07:19 +01:00
..
assets UX: Remove new height variables from foundation modernization [backport 2026.5] (#41986) 2026-07-23 11:11:46 -05:00
controllers SECURITY: DoS vis uncapped Bulk Topic Actions [backport 2026.5] (#42003) 2026-07-23 23:07:19 +01:00
helpers SECURITY: Bind shared session key to auth token and enforce user gates [backport 2026.5] (#41644) 2026-07-14 13:25:33 +08:00
jobs SECURITY: Prevent any signed AWS SNS TopicARN from being accepted via webhooks [backport 2026.5] 2026-06-30 16:17:06 +02:00
mailers DEV: Enable Style/RedundantParentheses rubocop rule (#40095) 2026-05-19 15:48:09 +02:00
models PERF: Avoid unnecessary upcoming change lookups for group lists [backport 2026.5] (#41910) 2026-07-23 05:31:13 +08:00
queries/reports FIX: Enforce can_see_ip checks across admin IP features (#40019) 2026-05-19 11:37:20 +08:00
serializers SECURITY: Reviewable conversations expose post-voting flag PM excerpts to category moderators outside the PM [backport 2026.5] (#41530) 2026-07-07 15:38:07 -05:00
services SECURITY: Stale featured rows expose unlisted topic content [backport 2026.5] (#41812) 2026-07-17 09:38:39 -05:00
views DEV: Drop media-minmax polyfill (#40335) 2026-05-27 20:26:21 +01:00