Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-09 21:45:25 +08:00
Code Packages Activity Actions
discourse/plugins/discourse-solved/spec
History
Exact
discoursebot b8a41f1822
 SECURITY: /solution/by_user leaks whisper/hidden accepted-answer post [backport 2026.5] (#41491) 
Backport of #41479 to release/2026.5.

---

## Summary

Prevent the unauthorized disclosure of hidden or whisper posts through
the `/solution/by_user` endpoint. The patch ensures that only posts
visible to the current visitor are returned by applying post-level
visibility filters and guardian authorization checks during
serialization.

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/1400

Co-authored-by: discourse-patch-triage
<272280883+discourse-patch-triage[bot]@users.noreply.github.com>

---------

Co-authored-by: Isaac Janzen <50783505+janzenisaac@users.noreply.github.com>
Co-authored-by: discourse-patch-triage[bot] <272280883+discourse-patch-triage[bot]@users.noreply.github.com>
2026-07-07 10:43:13 -05:00
..
components DEV: add service objects for accept_answer and unaccept_answer (#37878) 2026-03-04 12:34:37 +04:00
fabricators FEATURE: add solved me too button (#39652) 2026-05-13 17:03:25 +04:00
integration FEATURE: Admin dashboard highlights to real data (#39895) 2026-05-12 13:15:52 +08:00
lib DEV: Scaffold backend for the new admin dashboard Reports section (#40017) 2026-05-20 09:53:26 +03:00
models FEATURE: add solved me too button (#39652) 2026-05-13 17:03:25 +04:00
requests SECURITY: /solution/by_user leaks whisper/hidden accepted-answer post [backport 2026.5] (#41491) 2026-07-07 10:43:13 -05:00
serializers DEV: update solved schema for non text posts (#39253) 2026-04-16 19:42:48 +04:00
services/discourse_solved UX: don't include OP in "me too" shared issue counter (#40129) 2026-05-18 13:29:53 -04:00
system DEV: Remove enable_simplified_category_creation old code (#40108) 2026-05-27 10:04:46 +10:00