Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-06 02:19:55 +08:00
Code Packages Activity Actions
discourse/spec
History
Exact
Isaac Janzen 1cbd5b6ba8
 FIX: Authorize topic visibility before recording or deleting read timings (#42176) 
## Summary

Authenticated users could submit read timings for topics hidden by
category permissions, creating false read records and incrementing their
post-read counter. Added a topic visibility guard
(`find_visible_topic_from_topic_id`) to both the timing creation and
deletion controller actions, so inaccessible topics return a 404
response and no timing state is mutated.

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/1499

Co-authored-by: discourse-patch-triage
<272280883+discourse-patch-triage[bot]@users.noreply.github.com>
2026-07-30 10:57:33 -05:00
..
db FIX: Prevent backslash accumulation in upload markdown labels (#39461) 2026-06-03 18:10:38 +02:00
fabricators PERF: Serve the activity_by_category report from daily rollups (#42046) 2026-07-28 12:53:29 +08:00
fixtures DEV: Add image-processing regression coverage (#42117) 2026-07-30 15:28:07 +08:00
generator DEV: Enable Rails/FilePath rubocop rule (#40097) 2026-05-19 19:07:54 +02:00
helpers UX: Hide signup when the site is in read only or staff only mode (#42101) 2026-07-28 20:05:04 +02:00
import_export
initializers FIX: Do not notify new sites or plugins enabled of old upcoming changes (#42045) 2026-07-30 09:51:08 +10:00
integration FIX: store method in route matcher (#41512) 2026-07-07 11:49:56 -04:00
integrity DEV: hide and disable upcoming changes for disabled plugins (#41657) 2026-07-16 14:35:20 +04:00
jobs DEV: Prefer RSpec primitives for test setup (#42122) 2026-07-30 11:17:22 +08:00
lib FIX: Address health check rate limiter review 2026-07-30 13:36:14 +00:00
mailers DEV: remove simple email subject upcoming change metadata (#41807) 2026-07-20 14:43:00 +04:00
migrations FIX: Ensure each flag gets a unique name_key (#40899) 2026-06-24 16:37:59 +02:00
models DEV: Add image-processing regression coverage (#42117) 2026-07-30 15:28:07 +08:00
multisite DEV: Enable Rails/FilePath rubocop rule (#40097) 2026-05-19 19:07:54 +02:00
queries/reports FEATURE: Change default upcoming change promotion status to Beta (#41275) 2026-07-06 09:13:37 +10:00
requests FIX: Authorize topic visibility before recording or deleting read timings (#42176) 2026-07-30 10:57:33 -05:00
script DEV: Fix UC status report when reverted files encountered (#41821) 2026-07-20 16:37:35 +10:00
serializers FIX: Preserve safe formatting in reviewable reasons (#42164) 2026-07-30 17:07:08 +02:00
services FIX: Restrict upcoming-changes toggle to registered upcoming-change settings (#42175) 2026-07-30 09:28:04 -05:00
support DEV: Add image-processing regression coverage (#42117) 2026-07-30 15:28:07 +08:00
system UX: UC:composer redesign > hide toolbar toggle (#42159) 2026-07-30 14:24:05 +02:00
tasks DEV: Prefer RSpec primitives for test setup (#42122) 2026-07-30 11:17:22 +08:00
views
rails_helper.rb DEV: Prefer RSpec primitives for test setup (#42122) 2026-07-30 11:17:22 +08:00
regenerate_swagger_docs
swagger_helper.rb