Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-08 17:53:55 +08:00
Code Packages Activity Actions
discourse/plugins/discourse-calendar/lib/discourse_post_event
History
Exact
Chris Alberti c253fb0197
 SECURITY: Remove stale invitee access for users removed from invited groups on private events (#42187) 
## Summary

Correctly restrict private calendar event access to current group
members. The patch replaces stale invitee-row authorization with active
invited-group membership checks across event detail serialization,
attendance searches, RSVP mutations, and livestream chat metadata, and
prunes stale invitee records when a user is removed from a group.

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/1377

Co-authored-by: discourse-patch-triage
<272280883+discourse-patch-triage[bot]@users.noreply.github.com>
2026-07-30 15:15:46 -05:00
..
email_renderer.rb FIX: Cook event location and description as inline markdown (#41994) 2026-07-28 18:59:23 +02:00
engine.rb
event_excerpt.rb FIX: Cook event location and description as inline markdown (#41994) 2026-07-28 18:59:23 +02:00
event_finder.rb SECURITY: Remove stale invitee access for users removed from invited groups on private events (#42187) 2026-07-30 15:15:46 -05:00
event_onebox_data.rb FEATURE: render links to event topics as interactive cards (#40953) 2026-07-17 10:36:54 -04:00
event_parser.rb FIX: Cook event location and description as inline markdown (#41994) 2026-07-28 18:59:23 +02:00
event_validator.rb
export_csv_controller_extension.rb
export_csv_file_extension.rb FIX: re-validate permissions when running CSV export job (#41464) 2026-07-06 16:50:06 +05:30
post_extension.rb DEV: Enable Style/RedundantSelf rubocop rule (#40098) 2026-05-19 19:27:45 +02:00
rrule_configurator.rb FEATURE: simplifed event creation in the composer (#39835) 2026-05-26 15:04:05 -04:00
rrule_generator.rb FIX: maintain wall clock time between DST transitions (#35833) 2025-11-07 13:25:56 +01:00
topic_extension.rb FIX: Topic Merging with Events (#41369) 2026-07-02 13:30:34 -05:00
web_hook_extension.rb FEAT: add images to post event events (#38643) 2026-04-13 09:45:06 -05:00