mirror of
https://github.com/discourse/discourse.git
synced 2026-08-09 21:45:25 +08:00
b8a41f1822Backport of #41479 to release/2026.5. --- ## Summary Prevent the unauthorized disclosure of hidden or whisper posts through the `/solution/by_user` endpoint. The patch ensures that only posts visible to the current visitor are returned by applying post-level visibility filters and guardian authorization checks during serialization. ## Source - Patch Triage: https://patch.discourse.org/patch-triage/1400 Co-authored-by: discourse-patch-triage <272280883+discourse-patch-triage[bot]@users.noreply.github.com> --------- Co-authored-by: Isaac Janzen <50783505+janzenisaac@users.noreply.github.com> Co-authored-by: discourse-patch-triage[bot] <272280883+discourse-patch-triage[bot]@users.noreply.github.com> |
||
|---|---|---|
| .. | ||
| controllers/discourse_solved | ||
| models/discourse_solved | ||
| serializers | ||
| services/discourse_solved | ||
