mirror of
https://github.com/discourse/discourse.git
synced 2026-08-08 17:53:55 +08:00
baa573d414Previously, filtering a user search by group (e.g. `/u/search/users?groups=admins`) only checked whether the requester could see the group's members, not the group itself. Because the default automatic groups are visible to logged-in users but expose their members publicly, an anonymous or non-member user could enumerate the members of a group hidden from them, even though every other path that lists users by group (the user directory, `/g/:name/members`, group topic lists) already required both checks. This adds a `Guardian#can_see_group_and_members?` helper that requires both group and member visibility, and routes the user search, user directory, and plugin group-listing paths through it. This closes the leak, fixes a related all-or-nothing bug in `can_see_groups?` when several groups are filtered at once, and keeps the rule in one place so a caller can no longer reintroduce it by checking only half. |
||
|---|---|---|
| .. | ||
| controllers/discourse_assign | ||
| jobs | ||
| mailers | ||
| models | ||
| serializers | ||
