Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-06 13:08:40 +08:00
Code Packages Activity Actions
discourse/app/controllers
History
Exact
discoursebot d42085f16a
 SECURITY: DoS vis uncapped Bulk Topic Actions [backport 2026.5] (#42003) 
Backport of #42001 to release/2026.5.

---

## Summary

Limit and deduplicate topic_ids for bulk actions.

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/1477

Co-authored-by: discourse-patch-triage
<272280883+discourse-patch-triage[bot]@users.noreply.github.com>

Co-authored-by: David Taylor <david@taylorhq.com>
2026-07-23 23:07:19 +01:00
..
admin DEV: Rename anonymous group to anonymous_users (#40435) (#40629) 2026-06-09 10:24:11 +10:00
users FEATURE: Prompt anonymous users to sign up after engagement clicks (#40256) 2026-05-26 09:30:38 +02:00
about_controller.rb
anonymous_actions_controller.rb FEATURE: Prompt anonymous users to sign up after engagement clicks (#40256) 2026-05-26 09:30:38 +02:00
application_controller.rb DEV: Capture destination url and redirect when required user fields are present (#40207) 2026-05-26 14:22:29 -05:00
associated_groups_controller.rb
badges_controller.rb FIX: Non-listable and disabled badges exposed via XHR JSON requests (#37869) 2026-02-17 16:17:01 +11:00
bookmarks_controller.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
bootstrap_controller.rb DEV: Refactor plugin JS handling (#37763) 2026-02-19 12:24:04 +00:00
calendar_subscriptions_controller.rb FEATURE: Add calendar subscription URLs to user preferences (#38598) 2026-03-17 10:28:20 -03:00
categories_controller.rb DEV: Remove enable_simplified_category_creation old code (#40108) 2026-05-27 10:04:46 +10:00
clicks_controller.rb SECURITY: Missing visibility check in click tracking endpoint [backport 2026.5] (#41146) 2026-06-24 15:56:21 +10:00
composer_controller.rb SECURITY: Respect group member visibility for counts [backport 2026.5] (#41410) 2026-07-06 12:47:53 +08:00
composer_messages_controller.rb SECURITY: Whisper metadata disclosure via stale TopicLinks [backport 2026.5] (#41142) 2026-06-24 15:58:23 +10:00
dev_mode_controller.rb DEV: Add /dev-mode endpoint for MiniProfiler auth cookie (#37027) 2026-01-12 10:01:20 +08:00
directory_columns_controller.rb
directory_items_controller.rb SECURITY: Private UserField value disclosure via directory_items order sort side-channel [backport 2026.5] (#41600) 2026-07-09 21:53:43 -05:00
do_not_disturb_controller.rb
drafts_controller.rb FIX: Drafts/reviewables API returned 404 when acting on own resource (#39449) 2026-05-26 09:29:20 +02:00
edit_directory_columns_controller.rb DEV: Enable Style/RedundantParentheses rubocop rule (#40095) 2026-05-19 15:48:09 +02:00
email_controller.rb FEATURE: implement RFC 8058 for email unsubscribe (#33392) 2025-07-01 11:01:13 +10:00
embed_controller.rb FIX: Apply embed class_name to <html> in full app mode (#40344) 2026-05-27 17:31:03 -03:00
emojis_controller.rb FEATURE: Locale-specific emoji search aliases (#39089) 2026-04-06 14:08:46 -03:00
exceptions_controller.rb
export_csv_controller.rb DEV: Enable Style/RedundantParentheses rubocop rule (#40095) 2026-05-19 15:48:09 +02:00
extra_locales_controller.rb DEV: Refactor locale bundle loading (#37114) 2026-01-16 11:45:14 +00:00
finish_installation_controller.rb DEV: Enable Style/RedundantBegin rubocop rule (#40096) 2026-05-19 18:44:54 +02:00
form_templates_controller.rb SECURITY: Scope form template endpoints to accessible categories 2026-05-19 00:26:04 +01:00
forums_controller.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
groups_controller.rb SECURITY: mentionable/messageable endpoints bypassing visibility controls [backport 2026.5] (#41522) 2026-07-07 14:38:49 -05:00
hashtags_controller.rb
highlight_js_controller.rb
home_page_controller.rb DEV: Show login-required splash in root route (take 2) (#32629) 2025-05-14 11:25:43 -04:00
inline_onebox_controller.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
invites_controller.rb FEATURE: Prompt anonymous users to sign up after engagement clicks (#40256) 2026-05-26 09:30:38 +02:00
list_controller.rb SECURITY: Harden ListController top period query against SQL injection [backport 2026.5] (#41722) 2026-07-15 12:18:18 +08:00
metadata_controller.rb DEV: Fix assigned but unused variable Prism warnings (#39436) 2026-04-22 12:42:14 +02:00
nested_topics_controller.rb FIX: Apply embed class_name to <html> in full app mode (#40344) 2026-05-27 17:31:03 -03:00
new_invite_controller.rb
new_topic_controller.rb
notifications_controller.rb FIX: Hide badge notifications for disabled badges or when badges are disabled (#36987) 2026-01-07 15:28:43 +08:00
offline_controller.rb
onebox_controller.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
permalinks_controller.rb SECURITY: prevent permalink redirects from leaking restricted slugs 2026-01-28 17:11:14 +00:00
post_action_users_controller.rb UX: Ignored users reactions/likes should not show up (#39672) 2026-05-11 15:32:29 -03:00
post_actions_controller.rb SECURITY: fix is_warning type coercion bypass in PostActionsController 2026-03-19 15:21:28 +00:00
post_localizations_controller.rb FIX: Also check if user can see post or topic prior to letting them localize it (#36749) 2025-12-18 02:12:58 +08:00
post_readers_controller.rb SECURITY: Missing post-level authorization allows whisper metadata disclosure 2026-03-31 15:12:45 +01:00
posts_controller.rb SECURITY: PostsController#raw_email leaks raw emails of inaccessible to mods [backport 2026.5] (#41965) 2026-07-23 16:36:33 +10:00
presence_controller.rb FIX: improve "read only" modes (#33521) 2025-07-10 09:08:00 +02:00
published_pages_controller.rb FIX: ensures only staff can check slugs (#37846) 2026-02-16 18:23:46 +01:00
push_notification_controller.rb
qunit_controller.rb DEV: Refactor plugin JS handling (#37763) 2026-02-19 12:24:04 +00:00
reviewable_claimed_topics_controller.rb DEV: Convert ReviewableClaimedTopicsController#destroy response from 403 to 404 (#38339) 2026-03-06 15:39:51 -06:00
reviewable_notes_controller.rb SECURITY: scope reviewable notes to user-visible reviewables 2026-02-26 12:22:54 +00:00
reviewables_controller.rb FIX: Drafts/reviewables API returned 404 when acting on own resource (#39449) 2026-05-26 09:29:20 +02:00
robots_txt_controller.rb DEV: Update link to comment in robots.txt as 'allow' is allowed (#33227) 2025-06-18 13:30:26 +08:00
safe_mode_controller.rb FIX: Set X-Robots-Tag header to prevent indexing of /safe-mode (#32329) 2025-04-16 16:51:32 +10:00
search_controller.rb FIX: exclude 't' shortcut from min length bypass (#37440) 2026-02-05 06:58:19 +11:00
session_controller.rb FEATURE: Prompt anonymous users to sign up after engagement clicks (#40256) 2026-05-26 09:30:38 +02:00
sidebar_sections_controller.rb FIX: raise 404 when sidebar section doesn't exist (#37675) 2026-02-10 15:47:49 +01:00
similar_topics_controller.rb FEATURE: First iteration of nested replies (#38888) 2026-04-16 08:06:44 -05:00
site_controller.rb
sitemap_controller.rb
slugs_controller.rb
static_controller.rb DEV: Move 4 upcoming changes to stable (#39066) 2026-04-07 10:05:49 +10:00
steps_controller.rb UX: One step wizard (#36082) 2025-11-25 13:35:32 -05:00
stylesheets_controller.rb DEV: Enable Style/RedundantBegin rubocop rule (#40096) 2026-05-19 18:44:54 +02:00
svg_sprite_controller.rb DEV: Enable Style/RedundantParentheses rubocop rule (#40095) 2026-05-19 15:48:09 +02:00
tag_groups_controller.rb FIX: Failed updates in tag group controller would be logged (#38333) 2026-03-06 17:11:12 -03:00
tag_localizations_controller.rb FEATURE: Introduce tag localizations with API, without UI yet (#36754) 2025-12-18 18:25:58 +08:00
tag_param_limit.rb SECURITY: Reject too many tags during post creation [backport 2026.5] (#41399) 2026-07-03 14:40:39 +08:00
tags_controller.rb FIX: Make tag search consistently honour category access (#39399) 2026-05-22 18:48:15 +02:00
test_requests_controller.rb
theme_javascripts_controller.rb DEV: Enable Rails/FilePath rubocop rule (#40097) 2026-05-19 19:07:54 +02:00
topic_localizations_controller.rb UX: Use inline title editor instead of composer when editing translation (#36847) 2025-12-24 00:56:36 +08:00
topic_view_stats_controller.rb
topics_controller.rb SECURITY: DoS vis uncapped Bulk Topic Actions [backport 2026.5] (#42003) 2026-07-23 23:07:19 +01:00
uploads_controller.rb DEV: Enable Style/RedundantBegin rubocop rule (#40096) 2026-05-19 18:44:54 +02:00
user_actions_controller.rb SECURITY: Enforce Guardian checks in UserActionsController#show 2026-03-19 15:21:28 +00:00
user_api_key_clients_controller.rb FIX: Empty-scopes bypass allows untrusted client registration and downstream scope/redirect policy bypass (#37855) 2026-02-17 12:39:09 +11:00
user_api_keys_controller.rb FIX: rescue OpenSSL::PKey::RSAError in UserApiKeysController (#39889) 2026-05-11 14:57:38 -04:00
user_avatars_controller.rb SECURITY: Improve SVG sanitization [backport 2026.5] 2026-06-30 16:17:06 +02:00
user_badges_controller.rb SECURITY: Prevent badge lookup from exposing hidden profiles [backport 2026.5] (#41161) 2026-06-25 14:11:19 +08:00
user_status_controller.rb
users_controller.rb SECURITY: An unauthorized user can delete emails of other users including Admins [backport 2026.5] (#41929) 2026-07-22 12:17:26 -05:00
users_email_controller.rb FIX: enforces login for create in user emails controller (#37770) 2026-02-12 17:10:43 +01:00
webhooks_controller.rb SECURITY: Prevent any signed AWS SNS TopicARN from being accepted via webhooks [backport 2026.5] 2026-06-30 16:17:06 +02:00
wizard_controller.rb