Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-09 21:45:25 +08:00
Code Packages Activity Actions
discourse/plugins/chat
History
Exact
discoursebot 611a5442d3
 SECURITY: Enforce recipient PM allowlists for existing direct chat channels [backport 2026.5] (#41925) 
Backport of #41923 to release/2026.5.

---

## Summary

Correctly enforce the PM allowlist preference
(`enable_allowed_pm_users`) when an excluded user attempts to send a
message in an existing one-to-one direct message channel. Previously,
the Guardian helper did not check the allowlist, allowing excluded users
to continue sending messages after the recipient enabled the
restriction. The fix integrates `UserCommScreener` into the recipient
authorization check, also preventing thread creation and updating user
card chat availability accordingly.

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/1454

Co-authored-by: discourse-patch-triage
<272280883+discourse-patch-triage[bot]@users.noreply.github.com>

Co-authored-by: Isaac Janzen <50783505+janzenisaac@users.noreply.github.com>
2026-07-22 12:11:58 -05:00
..
admin/assets/javascripts DEV: Consolidate reusable components into ui-kit (#38703) 2026-05-11 18:07:36 -03:00
app SECURITY: Enforce chat message length before cooking it [backport 2026.5] (#41752) 2026-07-16 11:10:29 +08:00
assets DEV: Remove enable_simplified_category_creation old code (#40108) 2026-05-27 10:04:46 +10:00
config I18N: Update translations (#41120) 2026-06-23 17:52:17 +02:00
db DEV: Enable Style/RedundantBegin rubocop rule (#40096) 2026-05-19 18:44:54 +02:00
lib SECURITY: Enforce recipient PM allowlists for existing direct chat channels [backport 2026.5] (#41925) 2026-07-22 12:11:58 -05:00
public
spec SECURITY: Enforce recipient PM allowlists for existing direct chat channels [backport 2026.5] (#41925) 2026-07-22 12:11:58 -05:00
test/javascripts UX: Show avatar when only 1 other user in chat group DM (#40269) 2026-05-26 09:37:47 +10:00
about.json DEV: Only load specific plugin bundles during qunit test (#33678) 2025-07-21 21:00:48 +01:00
package.json DEV: Add a script for generating external types in discourse-types (#37095) 2026-03-09 20:37:43 +01:00
plugin.rb DEV: Enable Style/RedundantSelf rubocop rule (#40098) 2026-05-19 19:27:45 +02:00
README.md
tsconfig.json DEV: Add a script for generating external types in discourse-types (#37095) 2026-03-09 20:37:43 +01:00

README.md

This plugin is still in active development and may change frequently

Documentation

The Discourse Chat plugin adds chat functionality to your Discourse so it can natively support both long-form and short-form communication needs of your online community.

For user documentation, see Discourse Chat.

For developer documentation, see Discourse Documentation.