Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-08 17:53:55 +08:00
Code Packages Activity Actions
discourse/plugins/discourse-presence
History
Exact
discoursebot 77a33a9382
 SECURITY: Authorization bypass in wiki edit presence leaks editor identities [backport 2026.5] (#41481) 
Backport of #41474 to release/2026.5.

---

## Summary

Correctly restrict wiki edit presence information to authorized users by
intersecting global edit permissions with topic-level security groups.
This prevents users outside of a private category from observing editor
identities via the presence API.

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/1402

Co-authored-by: discourse-patch-triage
<272280883+discourse-patch-triage[bot]@users.noreply.github.com>

Co-authored-by: Isaac Janzen <50783505+janzenisaac@users.noreply.github.com>
2026-07-06 13:10:03 -05:00
..
assets DEV: Consolidate reusable components into ui-kit (#38703) 2026-05-11 18:07:36 -03:00
config I18N: Update translations (#40165) 2026-05-22 11:36:52 +02:00
spec/integration SECURITY: Authorization bypass in wiki edit presence leaks editor identities [backport 2026.5] (#41481) 2026-07-06 13:10:03 -05:00
test/javascripts/acceptance FEATURE: Add presence indicators for translating posts (#35857) 2025-11-06 06:40:04 -08:00
package.json DEV: Add a script for generating external types in discourse-types (#37095) 2026-03-09 20:37:43 +01:00
plugin.rb SECURITY: Authorization bypass in wiki edit presence leaks editor identities [backport 2026.5] (#41481) 2026-07-06 13:10:03 -05:00
README.md
tsconfig.json DEV: Add a script for generating external types in discourse-types (#37095) 2026-03-09 20:37:43 +01:00

README.md

Discourse Presence plugin

This plugin shows which users are currently writing a reply at the same time as you.