Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-09 21:45:25 +08:00
Code Packages Activity Actions
discourse/spec
History
Exact
discoursebot d42085f16a
 SECURITY: DoS vis uncapped Bulk Topic Actions [backport 2026.5] (#42003) 
Backport of #42001 to release/2026.5.

---

## Summary

Limit and deduplicate topic_ids for bulk actions.

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/1477

Co-authored-by: discourse-patch-triage
<272280883+discourse-patch-triage[bot]@users.noreply.github.com>

Co-authored-by: David Taylor <david@taylorhq.com>
2026-07-23 23:07:19 +01:00
..
db DEV: Move Community sidebar section + links from migrations to seed fixture (#39973) 2026-05-13 12:13:12 +01:00
fabricators FEATURE: Add top countries and top referrers cards to the admin dashboard (#40215) 2026-05-22 12:59:16 +08:00
fixtures FIX: Better handling of github_folder onebox w/o opengraph tags (#39142) 2026-04-08 11:49:57 +02:00
generator DEV: Enable Rails/FilePath rubocop rule (#40097) 2026-05-19 19:07:54 +02:00
helpers SECURITY: Bind shared session key to auth token and enforce user gates [backport 2026.5] (#41644) 2026-07-14 13:25:33 +08:00
import_export
initializers SECURITY: Harden imagemagick execution [backport 2026.5] 2026-06-30 16:17:06 +02:00
integration FIX: Correctly rescue failed embed_mode parsing (#40298) 2026-05-26 15:29:48 +01:00
integrity DEV: Enforce learn_more_url for upcoming changes (#40150) 2026-05-20 16:18:28 +10:00
jobs SECURITY: Authorize secure-upload hotlink downloads against post user [backport 2026.5] 2026-06-30 16:17:06 +02:00
lib SECURITY: Bind shared session key to auth token and enforce user gates [backport 2026.5] (#41644) 2026-07-14 13:25:33 +08:00
mailers DEV: Automatically detect and revert translation overrides in specs (#40003) 2026-05-13 22:09:23 +02:00
models SECURITY: Harden ListController top period query against SQL injection [backport 2026.5] (#41722) 2026-07-15 12:18:18 +08:00
multisite DEV: Enable Rails/FilePath rubocop rule (#40097) 2026-05-19 19:07:54 +02:00
queries/reports FEATURE: Activity by category section of the new dashboard's engagement section (#40227) 2026-05-22 13:10:38 +08:00
requests SECURITY: DoS vis uncapped Bulk Topic Actions [backport 2026.5] (#42003) 2026-07-23 23:07:19 +01:00
script/import_scripts
serializers SECURITY: /directory_items leaks restricted user-field values [backport 2026.5] (#41484) 2026-07-06 14:26:23 -05:00
services SECURITY: Stale featured rows expose unlisted topic content [backport 2026.5] (#41812) 2026-07-17 09:38:39 -05:00
support FIX: type: objects uploads should be stored as IDs (#40178) 2026-05-21 13:45:27 -03:00
system DEV: Fix dashboard date picker spec [backport 2026.5] (#40701) 2026-06-09 18:23:14 +01:00
tasks FIX: type: objects uploads should be stored as IDs (#40178) 2026-05-21 13:45:27 -03:00
views
rails_helper.rb DEV: Fix dashboard date picker spec [backport 2026.5] (#40701) 2026-06-09 18:23:14 +01:00
regenerate_swagger_docs
swagger_helper.rb