Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-07 13:19:19 +08:00
Code Packages Activity Actions
discourse/app/controllers
History
Exact
Isaac Janzen cf34ec28e0
 FIX: Respect group member visibility in private-message read receipts (#42372) 
## Summary

Align private-message read receipts with recipient-group visibility
settings. `PostReadersController#ensure_can_see_readers!`
(`app/controllers/post_readers_controller.rb:42`) now returns reader
details only when the requester can view the membership of every
recipient group and belongs to a group with read-state publishing
enabled. `TopicView#show_read_indicator?` (`lib/topic_view.rb:297`)
applies the same visibility rule to the UI.

Realtime `:read` events from
`TopicTrackingState.trigger_post_read_count_update`
(`app/models/topic_tracking_state.rb:600`) continue to publish
`readers_count`, but no longer include `reader_id`. Reader identities
remain available through the authorized `/post_readers.json` endpoint.
Tests cover group private messages with restricted member visibility.

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/1151

Co-authored-by: discourse-patch-triage
<272280883+discourse-patch-triage[bot]@users.noreply.github.com>
2026-08-06 10:14:39 -05:00
..
admin FIX: handle email aliases when normalize emails is enabled (#42344) 2026-08-05 18:21:48 +04:00
users FEATURE: Allow HTML for OAuth error message (#41204) 2026-06-26 08:35:06 -05:00
about_controller.rb FEATURE: Allow selection of multiple content languages when viewing topics and posts (#42128) 2026-07-30 12:19:44 +08:00
access_control_lists_controller.rb FEATURE: Support users in DAccessControl and backend (#41358) 2026-07-15 09:18:06 +10:00
anonymous_actions_controller.rb FEATURE: Prompt anonymous users to sign up after engagement clicks (#40256) 2026-05-26 09:30:38 +02:00
application_controller.rb FIX: Gate permalink fallback redirects (#42224) 2026-07-31 12:39:09 -05:00
associated_groups_controller.rb
badges_controller.rb FIX: Non-listable and disabled badges exposed via XHR JSON requests (#37869) 2026-02-17 16:17:01 +11:00
bookmarks_controller.rb
calendar_subscriptions_controller.rb FEATURE: Add calendar subscription URLs to user preferences (#38598) 2026-03-17 10:28:20 -03:00
categories_controller.rb FIX: Avoid duplicate category updated events (#42406) 2026-08-06 20:54:09 +08:00
clicks_controller.rb SECURITY: Missing visibility check in click tracking endpoint (#41140) 2026-06-24 15:15:56 +10:00
composer_controller.rb SECURITY: Respect group member visibility for counts (#41403) 2026-07-06 12:48:06 +08:00
composer_messages_controller.rb SECURITY: Whisper metadata disclosure via stale TopicLinks (#41139) 2026-06-24 14:44:27 +10:00
dev_mode_controller.rb DEV: Add /dev-mode endpoint for MiniProfiler auth cookie (#37027) 2026-01-12 10:01:20 +08:00
directory_columns_controller.rb
directory_items_controller.rb SECURITY: Private UserField value disclosure via directory_items order sort side-channel (#41598) 2026-07-09 21:52:51 -05:00
do_not_disturb_controller.rb
drafts_controller.rb FIX: Drafts/reviewables API returned 404 when acting on own resource (#39449) 2026-05-26 09:29:20 +02:00
edit_directory_columns_controller.rb DEV: Enable Style/RedundantParentheses rubocop rule (#40095) 2026-05-19 15:48:09 +02:00
email_controller.rb
embed_controller.rb FIX: Add visibility check to Embed info (#40896) 2026-06-15 10:20:56 -05:00
emojis_controller.rb FEATURE: Add emoji_picker_pinned_groups for pinning groups in the picker (#41881) 2026-07-22 09:51:15 -07:00
exceptions_controller.rb
export_csv_controller.rb FIX: Race condition allows bypass of data export rate limit in Discourse (#41990) 2026-07-29 13:04:18 -05:00
extra_locales_controller.rb DEV: Refactor locale bundle loading (#37114) 2026-01-16 11:45:14 +00:00
finish_installation_controller.rb DEV: Enable Style/RedundantBegin rubocop rule (#40096) 2026-05-19 18:44:54 +02:00
form_templates_controller.rb SECURITY: Scope form template endpoints to accessible categories 2026-05-19 00:26:04 +01:00
forums_controller.rb
gifs_controller.rb FIX: move klipy gifs request to backend (#41540) 2026-07-08 17:18:42 +04:00
groups_controller.rb FIX: Restrict group SMTP settings updates to administrators (#42278) 2026-08-03 15:08:53 -05:00
hashtags_controller.rb
highlight_js_controller.rb
home_page_controller.rb
inline_onebox_controller.rb
invites_controller.rb FIX: Allow logged-in users to redeem invites when new registrations are disabled (#42026) 2026-07-25 17:02:30 +02:00
list_controller.rb FEATURE: explicit default homepage setting (#41785) 2026-07-22 16:22:19 -04:00
metadata_controller.rb FEATURE: Accept shared files via the Web Share Target (#41030) 2026-06-18 17:35:09 -03:00
nested_topics_controller.rb FIX: Add small action controls to nested activity log (#42108) 2026-07-29 10:19:47 -05:00
new_invite_controller.rb
new_topic_controller.rb
notifications_controller.rb FIX: Hide badge notifications for disabled badges or when badges are disabled (#36987) 2026-01-07 15:28:43 +08:00
offline_controller.rb
onebox_controller.rb
permalinks_controller.rb SECURITY: prevent permalink redirects from leaking restricted slugs 2026-01-28 17:11:14 +00:00
post_action_users_controller.rb UX: Ignored users reactions/likes should not show up (#39672) 2026-05-11 15:32:29 -03:00
post_actions_controller.rb FIX: Prevent flagging inaccessible topics (#42362) 2026-08-05 12:22:25 -05:00
post_localizations_controller.rb UX: Allow user to set post and topic title language when manually creating post translations in modal (#41734) 2026-07-16 10:43:39 +08:00
post_readers_controller.rb FIX: Respect group member visibility in private-message read receipts (#42372) 2026-08-06 10:14:39 -05:00
posts_controller.rb SECURITY: Block requests for hidden post revisions through historical version reconstruction (#42269) 2026-08-03 12:27:53 -05:00
presence_controller.rb
published_pages_controller.rb SECURITY: Leakage of hidden tags to unauthorized users (#42218) 2026-07-31 10:53:38 -05:00
push_notification_controller.rb
qunit_controller.rb DEV: Rename EmberCli to EmberAssets (#40938) 2026-06-16 12:56:56 +02:00
reviewable_claimed_topics_controller.rb FIX: Only record deliberate reviewable claims in the timeline (#42375) 2026-08-06 10:08:08 +02:00
reviewable_notes_controller.rb SECURITY: scope reviewable notes to user-visible reviewables 2026-02-26 12:22:54 +00:00
reviewables_controller.rb FIX: Drafts/reviewables API returned 404 when acting on own resource (#39449) 2026-05-26 09:29:20 +02:00
robots_txt_controller.rb DEV: Replace JS build system with Rolldown (#35963) 2026-05-29 11:11:55 +01:00
safe_mode_controller.rb
search_controller.rb FIX: exclude 't' shortcut from min length bypass (#37440) 2026-02-05 06:58:19 +11:00
session_controller.rb UX: Improve password manager and full name handling in code login (#41746) 2026-07-15 10:43:03 -07:00
sidebar_sections_controller.rb FIX: Base custom sidebar section translations on their source locale (#42027) 2026-08-03 17:49:42 +02:00
similar_topics_controller.rb FEATURE: First iteration of nested replies (#38888) 2026-04-16 08:06:44 -05:00
site_controller.rb
sitemap_controller.rb
slugs_controller.rb
static_controller.rb FIX: Localize static topic pages … (#41260) 2026-06-29 21:34:17 +08:00
steps_controller.rb
stylesheets_controller.rb PERF: Only recompile stylesheets when required (#41735) 2026-07-16 12:14:28 +01:00
svg_sprite_controller.rb DEV: Enable Style/RedundantParentheses rubocop rule (#40095) 2026-05-19 15:48:09 +02:00
tag_groups_controller.rb FIX: Consistently exclude synonyms and hidden tags from tag lists (#42364) 2026-08-05 20:29:35 +02:00
tag_localizations_controller.rb
tag_param_limit.rb SECURITY: Reject too many tags during post creation (#41395) 2026-07-03 14:40:27 +08:00
tags_controller.rb FIX: Consistently exclude synonyms and hidden tags from tag lists (#42364) 2026-08-05 20:29:35 +02:00
test_requests_controller.rb
theme_javascripts_controller.rb DEV: Enable Rails/FilePath rubocop rule (#40097) 2026-05-19 19:07:54 +02:00
topic_localizations_controller.rb UX: Allow user to set post and topic title language when manually creating post translations in modal (#41734) 2026-07-16 10:43:39 +08:00
topic_view_stats_controller.rb
topics_controller.rb FIX: Authorize topic visibility before recording or deleting read timings (#42176) 2026-07-30 10:57:33 -05:00
uploads_controller.rb FIX: Serve inline-safe uploads inline on the local file store (#40739) 2026-07-14 18:52:35 +01:00
user_actions_controller.rb FIX: Bound user-actions index limit at 100 (#42361) 2026-08-05 11:52:53 -05:00
user_api_key_clients_controller.rb FIX: Empty-scopes bypass allows untrusted client registration and downstream scope/redirect policy bypass (#37855) 2026-02-17 12:39:09 +11:00
user_api_keys_controller.rb Revert "FIX: Only allow OTPs to be generated from a browser session (#40964)" (#41875) 2026-07-22 18:18:02 +03:00
user_avatars_controller.rb SECURITY: Improve SVG sanitization 2026-06-30 16:10:52 +02:00
user_badges_controller.rb SECURITY: Prevent badge lookup from exposing hidden profiles (#41160) 2026-06-25 13:01:03 +08:00
user_status_controller.rb
users_controller.rb DEV: External IDs, and hidden groups to admins only. Allow moderators to see SSO when the moderators_view_sso_details site setting is enabled (#41496) 2026-08-03 11:25:34 -05:00
users_email_controller.rb FIX: enforces login for create in user emails controller (#37770) 2026-02-12 17:10:43 +01:00
webhooks_controller.rb SECURITY: Prevent any signed AWS SNS TopicARN from being accepted via webhooks 2026-06-30 16:10:52 +02:00
wizard_controller.rb