Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-05 21:16:17 +08:00
Code Packages Activity Actions
discourse/plugins/discourse-presence
History
Exact
Isaac Janzen 00afbffa10
 SECURITY: Authorization bypass in wiki edit presence leaks editor identities (#41474) 
## Summary

Correctly restrict wiki edit presence information to authorized users by
intersecting global edit permissions with topic-level security groups.
This prevents users outside of a private category from observing editor
identities via the presence API.

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/1402

Co-authored-by: discourse-patch-triage
<272280883+discourse-patch-triage[bot]@users.noreply.github.com>
2026-07-06 12:53:23 -05:00
..
assets DEV: remove use of body:has() in CSS (#40841) 2026-06-12 14:13:05 -04:00
config I18N: Update translations (#40165) 2026-05-22 11:36:52 +02:00
spec/integration SECURITY: Authorization bypass in wiki edit presence leaks editor identities (#41474) 2026-07-06 12:53:23 -05:00
test/javascripts/acceptance WIP: New "Post Type" dropdown in composer header (#38068) 2026-06-01 14:40:36 -05:00
package.json DEV: Add a script for generating external types in discourse-types (#37095) 2026-03-09 20:37:43 +01:00
plugin.rb SECURITY: Authorization bypass in wiki edit presence leaks editor identities (#41474) 2026-07-06 12:53:23 -05:00
README.md
tsconfig.json DEV: Add a script for generating external types in discourse-types (#37095) 2026-03-09 20:37:43 +01:00

README.md

Discourse Presence plugin

This plugin shows which users are currently writing a reply at the same time as you.