Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-07 13:19:19 +08:00
Code Packages Activity Actions
discourse/app
History
Exact
Isaac Janzen 1cbd5b6ba8
 FIX: Authorize topic visibility before recording or deleting read timings (#42176) 
## Summary

Authenticated users could submit read timings for topics hidden by
category permissions, creating false read records and incrementing their
post-read counter. Added a topic visibility guard
(`find_visible_topic_from_topic_id`) to both the timing creation and
deletion controller actions, so inaccessible topics return a 404
response and no timing state is mutated.

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/1499

Co-authored-by: discourse-patch-triage
<272280883+discourse-patch-triage[bot]@users.noreply.github.com>
2026-07-30 10:57:33 -05:00
..
assets FIX: Constrain official notice image dimensions to prevent topic layout disruption (#42177) 2026-07-30 09:10:51 -05:00
controllers FIX: Authorize topic visibility before recording or deleting read timings (#42176) 2026-07-30 10:57:33 -05:00
helpers FEATURE: Allow selection of multiple content languages when viewing topics and posts (#42128) 2026-07-30 12:19:44 +08:00
jobs FIX: Skip moved-post notifications for recipients who cannot see the destination topic (#42170) 2026-07-30 09:03:49 -05:00
mailers FEATURE: Log in with a one-time email code (#40804) 2026-06-17 12:34:48 -07:00
models DEV: Restore landlock problem-check (#42172) 2026-07-30 15:13:37 +01:00
queries/reports DEV: Remove reporting_improvements upcoming change (#41259) 2026-07-01 07:52:02 +08:00
serializers FIX: Preserve safe formatting in reviewable reasons (#42164) 2026-07-30 17:07:08 +02:00
services FIX: Restrict upcoming-changes toggle to registered upcoming-change settings (#42175) 2026-07-30 09:28:04 -05:00
views FIX: Preserve URI delimiters in ICS URL properties, removing TEXT escaping (#42107) 2026-07-28 14:53:16 -05:00