Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-06 13:08:40 +08:00
Code Packages Activity Actions
discourse/plugins
History
Exact
Isaac Janzen 633dcfe5ef
 SECURITY: anonymous users can read hidden real names via reaction-user endpoints [backport 2026.5] (#41934) 
Backport of #41931 to release/2026.5.

---

## Summary

Fix anonymous disclosure of hidden full names of reactors and likers via
reaction-user APIs when `enable_names` setting is disabled. The
`CustomReactionsController` now conditionally includes the `name` field
only when `enable_names` is enabled, ensuring the invariant that hidden
full names are not exposed to unauthenticated users.

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/1451

Co-authored-by: discourse-patch-triage
<272280883+discourse-patch-triage[bot]@users.noreply.github.com>
2026-07-22 14:11:20 -05:00
..
automation I18N: Update translations (#40822) 2026-06-12 16:19:30 +02:00
chat SECURITY: Enforce recipient PM allowlists for existing direct chat channels [backport 2026.5] (#41925) 2026-07-22 12:11:58 -05:00
checklist
discourse-adplugin I18N: Update translations (#41120) 2026-06-23 17:52:17 +02:00
discourse-affiliate
discourse-ai FIX: Bust cache so that group additions to AI helper can take effect [backport 2026.5] (#41602) 2026-07-09 23:18:33 +01:00
discourse-apple-auth I18N: Update translations (#40165) 2026-05-22 11:36:52 +02:00
discourse-assign SECURITY: Honor group visibility in discourse-assign group lookups [backport 2026.5] (#41195) 2026-06-25 13:58:12 -03:00
discourse-cakeday I18N: Update translations (#40165) 2026-05-22 11:36:52 +02:00
discourse-calendar SECURITY: Gate private event invitee details [backport 2026.5] 2026-06-30 16:17:06 +02:00
discourse-chat-integration I18N: Update translations (#40822) 2026-06-12 16:19:30 +02:00
discourse-data-explorer SECURITY: Group report details expose raw Data Explorer SQL to non-admin group members [backport 2026.5] (#40949) 2026-06-16 14:13:43 -05:00
discourse-details
discourse-gamification I18N: Update translations (#41120) 2026-06-23 17:52:17 +02:00
discourse-github I18N: Update translations (#40300) 2026-05-26 15:25:51 +02:00
discourse-graphviz SECURITY: Prevent Sidekiq DoS via Graphviz rendering [backport 2026.5] (#40748) 2026-06-10 18:02:11 +01:00
discourse-hcaptcha
discourse-lazy-videos DEV: Enable Rails/FilePath rubocop rule (#40097) 2026-05-19 19:07:54 +02:00
discourse-local-dates I18N: Update translations (#40300) 2026-05-26 15:25:51 +02:00
discourse-login-with-amazon I18N: Update translations (#40439) 2026-06-01 21:00:28 +02:00
discourse-lti
discourse-math I18N: Update translations (#40679) 2026-06-09 17:21:43 +02:00
discourse-microsoft-auth
discourse-narrative-bot I18N: Update translations (#40562) 2026-06-04 23:05:48 +02:00
discourse-oauth2-basic I18N: Update translations (#40788) 2026-06-11 12:09:30 +02:00
discourse-openid-connect I18N: Update translations (#40788) 2026-06-11 12:09:30 +02:00
discourse-patreon I18N: Update translations (#40439) 2026-06-01 21:00:28 +02:00
discourse-policy I18N: Update translations (#40822) 2026-06-12 16:19:30 +02:00
discourse-post-voting SECURITY: Reviewable conversations expose post-voting flag PM excerpts to category moderators outside the PM [backport 2026.5] (#41530) 2026-07-07 15:38:07 -05:00
discourse-presence SECURITY: Authorization bypass in wiki edit presence leaks editor identities [backport 2026.5] (#41481) 2026-07-06 13:10:03 -05:00
discourse-reactions SECURITY: anonymous users can read hidden real names via reaction-user endpoints [backport 2026.5] (#41934) 2026-07-22 14:11:20 -05:00
discourse-rewind I18N: Update translations (#41286) 2026-06-30 15:45:32 +02:00
discourse-rss-polling I18N: Update translations (#40788) 2026-06-11 12:09:30 +02:00
discourse-solved SECURITY: /solution/by_user leaks whisper/hidden accepted-answer post [backport 2026.5] (#41491) 2026-07-07 10:43:13 -05:00
discourse-subscriptions SECURITY: Subscription contributors expose full user profile fields to anonymous viewers [backport 2026.5] (#40892) 2026-06-15 10:24:17 -05:00
discourse-templates I18N: Update translations (#40165) 2026-05-22 11:36:52 +02:00
discourse-topic-voting I18N: Update translations (#40822) 2026-06-12 16:19:30 +02:00
discourse-user-notes I18N: Update translations (#40439) 2026-06-01 21:00:28 +02:00
discourse-zendesk-plugin FIX: preserve Zendesk webhook email attribution (#40115) 2026-05-18 21:04:47 +05:30
footnote I18N: Update translations (#41286) 2026-06-30 15:45:32 +02:00
poll SECURITY: Uncontrolled Resource Consumption in Number Poll Generation [backport 2026.5] (#41149) 2026-06-24 15:52:37 +10:00
spoiler-alert
styleguide I18N: Update translations (#40822) 2026-06-12 16:19:30 +02:00