0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-05 19:53:47 +08:00
discourse/app/controllers/composer_messages_controller.rb
Sam fc1946e3f9
SECURITY: Whisper metadata disclosure via stale TopicLinks (#41139)
## Summary

Regular users can access metadata (URL, author, timestamp) of links in
staff-only whisper posts or deleted posts via the composer messages
endpoint because the lookup logic failed to verify post visibility
permissions.

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/1158
- HackerOne report: https://hackerone.com/reports/3721825

---

🤖 Auto-generated from the patch diff via Patch Triage. Review carefully
before merging.

Co-authored-by: discourse-patch-triage
<272280883+discourse-patch-triage[bot]@users.noreply.github.com>
2026-06-24 14:44:27 +10:00

38 lines
1 KiB
Ruby
Vendored

# frozen_string_literal: true
class ComposerMessagesController < ApplicationController
requires_login
def index
finder =
ComposerMessagesFinder.new(current_user, params.slice(:composer_action, :topic_id, :post_id))
json = { composer_messages: [finder.find].compact }
if params[:topic_id].present?
topic = Topic.where(id: params[:topic_id]).first
if guardian.can_see?(topic)
json[:extras] = { duplicate_lookup: TopicLink.duplicate_lookup(topic, guardian) }
end
end
render_json_dump(json, rest_serializer: true)
end
def user_not_seen_in_a_while
usernames = params.require(:usernames)
users = ComposerMessagesFinder.user_not_seen_in_a_while(usernames)
user_count = users.count
json = {
user_count: user_count,
usernames: users,
time_ago:
AgeWords.time_ago_in_words(
SiteSetting.pm_warn_user_last_seen_months_ago.month.ago,
true,
scope: :"datetime.distance_in_words_verbose",
),
}
render_json_dump(json)
end
end