Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-08 17:53:55 +08:00
Code Packages Activity Actions
discourse/plugins/discourse-solved
History
Exact
discoursebot b8a41f1822
 SECURITY: /solution/by_user leaks whisper/hidden accepted-answer post [backport 2026.5] (#41491) 
Backport of #41479 to release/2026.5.

---

## Summary

Prevent the unauthorized disclosure of hidden or whisper posts through
the `/solution/by_user` endpoint. The patch ensures that only posts
visible to the current visitor are returned by applying post-level
visibility filters and guardian authorization checks during
serialization.

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/1400

Co-authored-by: discourse-patch-triage
<272280883+discourse-patch-triage[bot]@users.noreply.github.com>

---------

Co-authored-by: Isaac Janzen <50783505+janzenisaac@users.noreply.github.com>
Co-authored-by: discourse-patch-triage[bot] <272280883+discourse-patch-triage[bot]@users.noreply.github.com>
2026-07-07 10:43:13 -05:00
..
app SECURITY: /solution/by_user leaks whisper/hidden accepted-answer post [backport 2026.5] (#41491) 2026-07-07 10:43:13 -05:00
assets DEV: Remove enable_simplified_category_creation old code (#40108) 2026-05-27 10:04:46 +10:00
config I18N: Update translations (#40822) 2026-06-12 16:19:30 +02:00
db DEV: Scaffold backend for the new admin dashboard Reports section (#40017) 2026-05-20 09:53:26 +03:00
lib DEV: Scaffold backend for the new admin dashboard Reports section (#40017) 2026-05-20 09:53:26 +03:00
public/images/upcoming_changes FEATURE: add solved me too button (#39652) 2026-05-13 17:03:25 +04:00
spec SECURITY: /solution/by_user leaks whisper/hidden accepted-answer post [backport 2026.5] (#41491) 2026-07-07 10:43:13 -05:00
test/javascripts DEV: Remove plugin names from test titles (#39418) 2026-04-21 19:19:52 +02:00
about.json
package.json DEV: Add a script for generating external types in discourse-types (#37095) 2026-03-09 20:37:43 +01:00
plugin.rb DEV: Enable Rails/FilePath rubocop rule (#40097) 2026-05-19 19:07:54 +02:00
README.md
tsconfig.json DEV: Add a script for generating external types in discourse-types (#37095) 2026-03-09 20:37:43 +01:00

README.md

Discourse Solved

Provides a solved button on designated categories

How to Install this Plugin

To install Discourse Plugin - https://meta.discourse.org/t/install-a-plugin/19157

How to Check if Plugin is installed

Go to Admin > Plugins

You should now see:

screen shot 2018-01-27 at 9 09 47 am

What to expect if Plugin is installed

Inside the Plugins, you will have the following options:

screen shot 2018-01-27 at 8 57 35 am

How to enable it in your posts

New Categories - Check ✅ Allow topic owner and staff to mark a reply as the solution

test2

Old Categories - Go to that Category > Edit > Settings > Check ✅ Allow topic owner and staff to mark a reply as the solution

BONUS: How to add badges to those who answered correctly

https://meta.discourse.org/t/discourse-solved-accepted-answer-plugin/30155

License

MIT