Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-06 06:24:48 +08:00
Code Packages Activity Actions
discourse/app/services
History
Exact
discoursebot 6df73c2da4
 SECURITY: Stale featured rows expose unlisted topic content [backport 2026.5] (#41812) 
Backport of #41810 to release/2026.5.

---

## Summary

Prevent the exposure of unlisted topic metadata in the categories
response by enforcing live visibility checks on featured topics.
Additionally, the UserSilencer service now correctly removes featured
topic records when bulk-hiding topics from new users, ensuring stale
records do not bypass visibility constraints.

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/1427

Co-authored-by: discourse-patch-triage
<272280883+discourse-patch-triage[bot]@users.noreply.github.com>

Co-authored-by: Bannon Tanner <bannon@discourse.org>
2026-07-17 09:38:39 -05:00
..
admin/search FIX: Enforce can_see_ip checks across admin IP features (#40019) 2026-05-19 11:37:20 +08:00
admin_notices FEATURE: Add problem checks page to admin panel and allow ignoring problem checks (#39103) 2026-04-23 08:28:33 +08:00
categories Revert "FIX: Moderators can enable plugins when enable_category_type_setup SiteSetting is enabled" (#40279) 2026-05-25 14:48:54 -05:00
category DEV: Replace Ruby numbered parameters by it where applicable (#37810) 2026-02-13 13:59:07 +01:00
discourse_id DEV: Allow new instances to be set up directly with Discourse ID (#36731) 2025-12-23 12:13:36 -05:00
flags FEATURE: allow edit custom flags (#32344) 2025-04-17 12:31:52 +08:00
groups DEV: Replace Ruby numbered parameters by it where applicable (#37810) 2026-02-13 13:59:07 +01:00
nested_topic REVERT: "FEATURE: Topic timeline for nested replies view (#40125)" (#40202) 2026-05-20 13:20:46 -05:00
notification/action FEATURE: Notify admins of upcoming changes and log events (#37003) 2026-01-21 12:45:54 +10:00
notifications
problem_check SECURITY: Prevent any signed AWS SNS TopicARN from being accepted via webhooks [backport 2026.5] 2026-06-30 16:17:06 +02:00
site_setting DEV: Enable Style/RedundantSelf rubocop rule (#40098) 2026-05-19 19:27:45 +02:00
spam_rule FIX: Moderator notifications when new post auto-silences a user (#35403) 2025-10-15 16:07:56 +08:00
tags FIX: Make tag search consistently honour category access (#39399) 2026-05-22 18:48:15 +02:00
themes DEV: Enable Style/RedundantSelf rubocop rule (#40098) 2026-05-19 19:27:45 +02:00
upcoming_changes FEATURE: Change upcoming change available notification cadence (#40157) 2026-05-25 09:38:33 +10:00
user FEATURE: Link staff action log entries to originating reviewable (#39519) 2026-04-30 09:15:45 +08:00
video_conversion DEV: Enable Style/RedundantBegin rubocop rule (#40096) 2026-05-19 18:44:54 +02:00
admin_dashboard_engagement.rb FEATURE: Activity by category section of the new dashboard's engagement section (#40227) 2026-05-22 13:10:38 +08:00
admin_dashboard_highlights.rb FEATURE: Admin dashboard highlights to real data (#39895) 2026-05-12 13:15:52 +08:00
admin_dashboard_section_configuration.rb FEATURE: Allow admins to configure sections in the experimental admin dashboard (#39964) 2026-05-13 18:03:39 +08:00
admin_dashboard_site_traffic.rb FEATURE: Add top countries and top referrers cards to the admin dashboard (#40215) 2026-05-22 12:59:16 +08:00
anonymous_shadow_creator.rb FEATURE: Anonymous shadow sessions can outlive suspension of the master account (#40156) 2026-05-20 12:07:56 +08:00
badge_granter.rb FEATURE: award badges based on topic votes received (#39493) 2026-04-28 10:53:06 +10:00
base_bookmarkable.rb SECURITY: Ensure guardian check when creating QueryGroupBookmark 2026-02-26 12:22:54 +00:00
category_hashtag_data_source.rb FIX: Use unaccent() for category name/slug search (#37622) 2026-02-12 08:43:23 +01:00
color_scheme_revisor.rb DEV: Enable Style/RedundantSelf rubocop rule (#40098) 2026-05-19 19:27:45 +02:00
destroy_task.rb DEV: Enable Style/RedundantBegin rubocop rule (#40096) 2026-05-19 18:44:54 +02:00
email_settings_exception_handler.rb DEV: Remove IMAP support in Discourse (#37002) 2026-01-12 10:07:26 +10:00
email_settings_validator.rb DEV: Enable Style/RedundantSelf rubocop rule (#40098) 2026-05-19 19:27:45 +02:00
email_style_updater.rb
external_upload_manager.rb SECURITY: Regular users can route multipart uploads into the admin backup store [backport 2026.5] 2026-06-30 16:17:06 +02:00
group_action_logger.rb PERF: Add Users to Group Improvements Pt. 2 (#38901) 2026-04-06 09:31:50 -05:00
group_mentions_updater.rb FIX: Sync category description when post content changes outside PostRevisor (#39184) 2026-05-11 16:13:23 +02:00
group_message.rb DEV: Don't allow context-free system post destruction (#32523) 2025-05-05 09:58:29 +08:00
handle_chunk_upload.rb DEV: Fix assigned but unused variable Prism warnings (#39436) 2026-04-22 12:42:14 +02:00
hashtag_autocomplete_service.rb DEV: Enable Style/RedundantSelf rubocop rule (#40098) 2026-05-19 19:27:45 +02:00
heat_settings_updater.rb
hub_push_notification_pusher.rb DEV: Centralize push notification delivery into a single job (#39207) 2026-04-14 11:55:45 -03:00
inline_uploads.rb DEV: Enable Style/RedundantParentheses rubocop rule (#40095) 2026-05-19 15:48:09 +02:00
locale_normalizer.rb FIX: Show localization for regionless locale if they exist (#33702) 2025-07-21 15:45:14 +08:00
notification_emailer.rb FIX: Send notification emails for staff-coloured posts (#37712) 2026-02-11 13:26:27 +01:00
post_action_notifier.rb DEV: route bulk tag actions through PostRevisor (#37848) 2026-02-24 14:39:01 +01:00
post_alerter.rb DEV: Enable some minor rubocop rules (#40094) 2026-05-19 15:29:38 +02:00
post_bookmarkable.rb DEV: Enable Style/RedundantSelf rubocop rule (#40098) 2026-05-19 19:27:45 +02:00
post_owner_changer.rb DEV: Enable Style/RedundantSelf rubocop rule (#40098) 2026-05-19 19:27:45 +02:00
push_notification_pusher.rb DEV: Enable Style/RedundantParentheses rubocop rule (#40095) 2026-05-19 15:48:09 +02:00
random_topic_selector.rb
registered_bookmarkable.rb FIX: Bookmarkable query placholders (#35935) 2025-11-10 12:36:53 +10:00
search_indexer.rb DEV: Enable Style/RedundantBegin rubocop rule (#40096) 2026-05-19 18:44:54 +02:00
sidebar_section_links_updater.rb
sidebar_site_settings_backfiller.rb
site_setting_update_existing_users.rb DEV: Enable Style/RedundantSelf rubocop rule (#40098) 2026-05-19 19:27:45 +02:00
site_settings_task.rb
staff_action_logger.rb FEATURE: Create staff action log when recovering posts (#40238) 2026-05-22 10:33:02 +02:00
tag_hashtag_data_source.rb FIX: Tag search 500 when content_localization is enabled (#37769) 2026-02-12 23:58:03 +08:00
tag_settings_updater.rb FIX: Tag settings can reassign hidden synonym tags by ID (#39778) 2026-05-07 11:01:51 +10:00
theme_settings_migrations_runner.rb DEV: Enable Rails/FilePath rubocop rule (#40097) 2026-05-19 19:07:54 +02:00
themes_install_task.rb DEV: Enable Style/RedundantParentheses rubocop rule (#40095) 2026-05-19 15:48:09 +02:00
topic_bookmarkable.rb DEV: Enable Style/RedundantSelf rubocop rule (#40098) 2026-05-19 19:27:45 +02:00
topic_status_updater.rb DEV: Enable Style/RedundantParentheses rubocop rule (#40095) 2026-05-19 15:48:09 +02:00
topic_timestamp_changer.rb
tracked_topics_updater.rb
trust_level_granter.rb
user_action_manager.rb DEV: Enable Style/RedundantSelf rubocop rule (#40098) 2026-05-19 19:27:45 +02:00
user_activator.rb FEATURE: Prompt anonymous users to sign up after engagement clicks (#40256) 2026-05-26 09:30:38 +02:00
user_anonymizer.rb DEV: Enable Style/RedundantSelf rubocop rule (#40098) 2026-05-19 19:27:45 +02:00
user_authenticator.rb DEV: Move more data into the server session (#35145) 2025-10-03 10:20:32 +02:00
user_destroyer.rb FEATURE: Link staff action log entries to originating reviewable (#39519) 2026-04-30 09:15:45 +08:00
user_merger.rb FIX: blocks post action merge for duplicated flags (#36265) 2025-11-26 16:17:57 -03:00
user_notification_renderer.rb
user_notification_schedule_processor.rb
user_password_expirer.rb DEV: Migrate user passwords data to UserPassword table (#28746) 2024-10-10 09:23:06 +08:00
user_silencer.rb SECURITY: Stale featured rows expose unlisted topic content [backport 2026.5] (#41812) 2026-07-17 09:38:39 -05:00
user_stat_count_updater.rb
user_suspender.rb FEATURE: Anonymous shadow sessions can outlive suspension of the master account (#40156) 2026-05-20 12:07:56 +08:00
user_updater.rb DEV: Enable Style/RedundantParentheses rubocop rule (#40095) 2026-05-19 15:48:09 +02:00
username_changer.rb DEV: Enable Style/RedundantSelf rubocop rule (#40098) 2026-05-19 19:27:45 +02:00
username_checker_service.rb
web_hook_emitter.rb
wildcard_domain_checker.rb
wildcard_url_checker.rb
word_watcher.rb FIX: Watched word with invalid regex crashes markdown cook (#40107) 2026-05-18 16:04:20 +08:00