Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-04 10:39:43 +08:00
Code Packages Activity Actions
discourse/app/serializers
History
Exact
Juan David Martínez Cubillos 54ed0fa270
 DEV: External IDs, and hidden groups to admins only. Allow moderators to see SSO when the moderators_view_sso_details site setting is enabled (#41496) 
#### Description

Moderators could access admin-only SSO, external identity and hidden
groups data via GET /admin/users/:id.json — the single_sign_on_record
field, external_ids field and hidden groups were serialized
unconditionally for all staff members instead of being restricted to
admins. This PR restricts External IDs, and hidden group to admins only
but allows moderators to see SSO information when the
`moderators_view_sso_details` SiteSetting is enabled

Context: `t/180409`
2026-08-03 11:25:34 -05:00
..
concerns FIX: Enforce can_see_ip checks across admin IP features (#40019) 2026-05-19 11:37:20 +08:00
custom_emoji DEV: Retroactive review and refactor of custom emoji bulk import/export (#41860) 2026-07-22 10:06:54 +10:00
about_serializer.rb
admin_badge_serializer.rb
admin_badges_serializer.rb
admin_category_badge_serializer.rb FEATURE: Category management UI for admins (#41218) 2026-07-15 09:17:25 +10:00
admin_category_serializer.rb UX: Minor improvements for admin category management (#41754) 2026-07-16 13:20:26 +10:00
admin_detailed_user_serializer.rb DEV: External IDs, and hidden groups to admins only. Allow moderators to see SSO when the moderators_view_sso_details site setting is enabled (#41496) 2026-08-03 11:25:34 -05:00
admin_email_template_serializer.rb UX: Display interpolation keys as interactive pills in admin editors (#37254) 2026-02-27 21:21:26 +01:00
admin_form_template_serializer.rb
admin_notice_serializer.rb
admin_plugin_serializer.rb
admin_user_action_serializer.rb
admin_user_list_serializer.rb FEATURE: Bulk suspend users and filter the admin users list by activation (#41227) 2026-06-29 11:26:34 +02:00
admin_user_serializer.rb DEV: External IDs, and hidden groups to admins only. Allow moderators to see SSO when the moderators_view_sso_details site setting is enabled (#41496) 2026-08-03 11:25:34 -05:00
admin_web_hook_event_serializer.rb
admin_web_hook_serializer.rb FIX: Allow selecting tags when creating or editing webhooks (#37942) 2026-02-20 23:00:50 +08:00
api_key_scope_serializer.rb DEV: Tidy plugin API key scope resource names (#38640) 2026-03-17 13:03:42 +11:00
api_key_serializer.rb
application_serializer.rb
archetype_serializer.rb
associated_group_serializer.rb
auth_provider_serializer.rb DEV: Add capability to pass an icon setting into auth provider registration (#34584) 2025-08-28 09:14:36 -05:00
backup_file_serializer.rb
badge_grouping_serializer.rb
badge_index_serializer.rb
badge_serializer.rb
badge_type_serializer.rb
basic_api_key_serializer.rb
basic_category_serializer.rb FEAT: category-specific topic title placeholder (#38593) 2026-03-16 10:23:57 -05:00
basic_group_history_serializer.rb SECURITY: Redact group history related to email password to group owners 2026-05-19 00:26:04 +01:00
basic_group_serializer.rb SECURITY: Respect group member visibility for counts (#41403) 2026-07-06 12:48:06 +08:00
basic_group_user_serializer.rb
basic_post_serializer.rb
basic_reviewable_flagged_post_serializer.rb
basic_reviewable_queued_post_serializer.rb
basic_reviewable_serializer.rb
basic_reviewable_user_serializer.rb
basic_theme_serializer.rb
basic_topic_serializer.rb FEATURE: Localize topic titles in notifications and bookmarks (#34059) 2025-08-05 12:12:22 +08:00
basic_user_badge_serializer.rb
basic_user_serializer.rb
category_and_topic_lists_serializer.rb
category_badge_serializer.rb DEV: Enable Style/RedundantParentheses rubocop rule (#40095) 2026-05-19 15:48:09 +02:00
category_detailed_serializer.rb SECURITY: Filter private subcategory counts from category listings (#41384) 2026-07-03 14:40:52 -04:00
category_group_serializer.rb
category_list_serializer.rb
category_required_tag_group_serializer.rb
category_serializer.rb SECURITY: Stop exposing hidden tag names through category serializers 2026-07-28 16:40:22 +02:00
category_upload_serializer.rb
color_scheme_color_serializer.rb FEATURE: Allow editing theme-owned palettes (#34722) 2025-10-06 09:02:39 +03:00
color_scheme_selectable_serializer.rb
color_scheme_serializer.rb FEATURE: add modifier to restrict theme color schemes (#38796) 2026-03-26 09:03:11 -04:00
component_index_serializer.rb
current_user_option_serializer.rb FEATURE: Allow selection of multiple content languages when viewing topics and posts (#42128) 2026-07-30 12:19:44 +08:00
current_user_serializer.rb FIX: Do not notify new sites or plugins enabled of old upcoming changes (#42045) 2026-07-30 09:51:08 +10:00
detailed_tag_serializer.rb SECURITY: Don't leak restricted tag group names via tag info 2026-05-19 00:26:04 +01:00
detailed_user_badge_serializer.rb DEV: Enable Style/RedundantParentheses rubocop rule (#40095) 2026-05-19 15:48:09 +02:00
directory_column_serializer.rb
directory_item_serializer.rb SECURITY: /directory_items leaks restricted user-field values (#41476) 2026-07-06 13:05:48 -05:00
discourse_version_check_serializer.rb FEATURE: Improve display of installed/available version on dashboard (#41165) 2026-06-24 13:07:05 +01:00
draft_serializer.rb FIX: DraftSerializer leaks real names of topic and post authors (#42197) 2026-07-31 09:17:27 -05:00
edit_directory_column_serializer.rb
email_log_serializer.rb
email_style_serializer.rb
embeddable_host_serializer.rb DEV: Expand top_tags, topic.tags, etc, to return an array of tag objects instead of tag names (#36678) 2026-02-02 10:03:02 +08:00
embedding_serializer.rb
emoji_serializer.rb FIX: Apply CDN to Custom Emojis loaded from S3/R2 (#41267) 2026-07-01 17:05:28 -04:00
flag_serializer.rb
flagged_topic_serializer.rb
flagged_topic_summary_serializer.rb
flagged_user_serializer.rb FEATURE: Allow suspending and silencing users from the review queue (#42205) 2026-07-31 14:47:40 +02:00
flair_group_serializer.rb
form_template_serializer.rb
found_group_serializer.rb FEATURE: Support users in DAccessControl and backend (#41358) 2026-07-15 09:18:06 +10:00
found_user_serializer.rb
gap_serializer.rb
group_post_serializer.rb FIX: Group post responses expose full names when name display is disabled (#39961) 2026-05-14 19:00:34 +10:00
group_post_user_serializer.rb
group_requester_serializer.rb
group_show_serializer.rb FIX: Ensure moderators do not clear group email domain (#39631) 2026-04-29 14:32:38 +08:00
group_user_serializer.rb
group_user_with_custom_fields_serializer.rb SECURITY: Respect hidden profile visibility in activity serializers (#41335) 2026-07-03 11:27:44 +08:00
grouped_screened_url_serializer.rb
grouped_search_result_serializer.rb
hidden_profile_serializer.rb UX: allow filter posts by user in user card with hidden profile (#35908) 2025-11-10 12:05:35 +08:00
inactive_user_serializer.rb UX: add filter button to user card of deactivated account (#36024) 2025-11-14 15:56:41 +08:00
incoming_email_details_serializer.rb FIX: Remove error section when viewing details for received emails (#35228) 2025-10-07 16:25:11 +08:00
incoming_email_serializer.rb FIX: Remove error section when viewing details for received emails (#35228) 2025-10-07 16:25:11 +08:00
invite_link_serializer.rb
invite_serializer.rb FEATURE: Allow inviting staff as admins or moderators (#41880) 2026-07-21 14:05:21 -07:00
invited_serializer.rb
invited_user_record_serializer.rb SECURITY: Respect hidden profile visibility in activity serializers (#41335) 2026-07-03 11:27:44 +08:00
invited_user_serializer.rb
listable_topic_serializer.rb DEV: Enable Style/RedundantParentheses rubocop rule (#40095) 2026-05-19 15:48:09 +02:00
new_post_result_serializer.rb
notification_serializer.rb FIX: Gate notification acting_user_name on enable_names setting (#42234) 2026-07-31 14:25:31 -05:00
optimized_video_serializer.rb DEV: Add video conversion support for chat messages (#36275) 2025-12-01 12:34:56 -07:00
penalty_counts_serializer.rb
pending_post_serializer.rb
permalink_serializer.rb
post_accordion_item_serializer.rb DEV: Allow multiple solutions in solved plugin (#39806) 2026-05-28 07:12:28 -05:00
post_action_type_serializer.rb
post_action_user_serializer.rb
post_item_excerpt.rb FIX: Bookmarked hidden post excerpts leak to unauthorized bookmark owners (#39873) 2026-05-15 14:04:05 +10:00
post_localization_serializer.rb
post_revision_serializer.rb FIX: Omit inaccessible reply target post numbers from post revision history (#41547) 2026-07-08 11:41:43 -05:00
post_serializer.rb FEATURE: Allow selection of multiple content languages when viewing topics and posts (#42128) 2026-07-30 12:19:44 +08:00
post_stream_serializer_mixin.rb DEV: Enable Style/RedundantBegin rubocop rule (#40096) 2026-05-19 18:44:54 +02:00
post_wordpress_serializer.rb
poster_serializer.rb
presence_channel_state_serializer.rb
primary_group_serializer.rb
private_message_topic_tracking_state_serializer.rb
problem_check_tracker_serializer.rb FEATURE: Add problem checks page to admin panel and allow ignoring problem checks (#39103) 2026-04-23 08:28:33 +08:00
published_page_serializer.rb
queued_post_serializer.rb
remote_theme_serializer.rb FEATURE: Show theme d-compat/* refs in admin UI (#40649) 2026-06-17 22:13:45 +01:00
reviewable_action_serializer.rb
reviewable_bundled_action_serializer.rb
reviewable_claimed_topic_serializer.rb
reviewable_conversation_post_serializer.rb
reviewable_conversation_serializer.rb
reviewable_editable_field_serializer.rb
reviewable_explanation_serializer.rb
reviewable_flagged_post_serializer.rb FIX: Show translated post in review queue when present (#40378) 2026-05-29 14:32:11 -04:00
reviewable_history_serializer.rb
reviewable_note_serializer.rb
reviewable_perform_result_serializer.rb FIX: Resolve all of a deleted spammer's reviewables (#40780) 2026-06-15 13:34:15 +08:00
reviewable_post_serializer.rb
reviewable_queued_post_serializer.rb SECURITY: Restrict raw email in queued post payloads 2026-05-19 00:26:04 +01:00
reviewable_score_explanation_serializer.rb
reviewable_score_serializer.rb FIX: Preserve safe formatting in reviewable reasons (#42164) 2026-07-30 17:07:08 +02:00
reviewable_score_type_serializer.rb
reviewable_serializer.rb DEV: Remove reviewable_ui_refresh feature flag and legacy code (#36752) 2026-02-23 10:45:36 +08:00
reviewable_settings_serializer.rb
reviewable_topic_serializer.rb
reviewable_user_serializer.rb DEV: Remove reviewable_ui_refresh feature flag and legacy code (#36752) 2026-02-23 10:45:36 +08:00
screened_email_serializer.rb FIX: Screened email list exposes IP addresses to moderators without IP-view permission (#39875) 2026-05-11 14:47:17 +08:00
screened_ip_address_serializer.rb
screened_url_serializer.rb FIX: Enforce can_see_ip checks across admin IP features (#40019) 2026-05-19 11:37:20 +08:00
search_logs_serializer.rb
search_post_serializer.rb FIX: Respect show_original for search results (#36042) 2025-11-17 12:06:08 +08:00
search_result_user_serializer.rb
search_topic_list_item_serializer.rb
sidebar_section_edit_serializer.rb FIX: Allow manual Community sidebar links to be localized (#41898) 2026-07-22 15:57:56 +08:00
sidebar_section_localization_serializer.rb FEATURE: Allow admins to localize custom sidebar section and links (#41795) 2026-07-21 21:45:50 +08:00
sidebar_section_serializer.rb FIX: Allow manual Community sidebar links to be localized (#41898) 2026-07-22 15:57:56 +08:00
sidebar_tag_serializer.rb FEATURE: Show localized tags (#37044) 2026-02-12 18:06:14 +08:00
sidebar_url_localization_serializer.rb FEATURE: Allow admins to localize custom sidebar section and links (#41795) 2026-07-21 21:45:50 +08:00
sidebar_url_serializer.rb FIX: Allow manual Community sidebar links to be localized (#41898) 2026-07-22 15:57:56 +08:00
similar_admin_user_serializer.rb FIX: Restore enabled checkboxes for similar users in penalty modals (#41801) 2026-07-17 17:14:39 +05:30
similar_topic_serializer.rb
single_sign_on_record_serializer.rb
site_category_serializer.rb SECURITY: Stop exposing hidden tag names through category serializers 2026-07-28 16:40:22 +02:00
site_serializer.rb SECURITY: Anonymous sidebar serialization exposes descriptions of category-restricted tags 2026-07-28 16:40:22 +02:00
site_text_serializer.rb DEV: Update rubocop (#38721) 2026-03-20 00:39:52 +01:00
skipped_email_log_serializer.rb
suggested_topic_serializer.rb FIX: Suggested topic links to nested replies topics (#40302) 2026-05-26 08:40:38 -05:00
suggested_topics_mixin.rb
tag_group_serializer.rb DEV: Move canonical tag routes to /tag/slug/id keeping /tag/name support (#37055) 2026-02-11 10:21:19 +08:00
tag_localization_serializer.rb FEATURE: Support markdown in tag descriptions (#41996) 2026-07-29 14:43:47 +01:00
tag_serializer.rb FEATURE: Support markdown in tag descriptions (#41996) 2026-07-29 14:43:47 +01:00
tag_settings_serializer.rb FEATURE: Support markdown in tag descriptions (#41996) 2026-07-29 14:43:47 +01:00
theme_field_serializer.rb UX: show SCSS files in theme admin "extra files" section (#35300) 2025-10-09 16:18:03 -04:00
theme_index_serializer.rb FEATURE: enhance screenshot support for themes with dark/light modes (#36422) 2025-12-10 11:23:21 +10:00
theme_objects_setting_metadata_serializer.rb FIX: support nested descriptions in object settings (#37538) 2026-02-05 14:01:58 -05:00
theme_serializer.rb FEATURE: add modifier to restrict theme color schemes (#38796) 2026-03-26 09:03:11 -04:00
theme_settings_serializer.rb DEV: Add disallowed_groups to theme/component settings (#41792) 2026-07-20 09:28:52 +10:00
theme_translation_serializer.rb
topic_embed_serializer.rb
topic_flag_type_serializer.rb
topic_link_serializer.rb FIX: Filter orphaned TopicLinks and normalize http URLs to https (#37098) 2026-01-15 12:12:34 +08:00
topic_list_item_serializer.rb FEATURE: Notification/tracking changes for nested replies (#39750) 2026-05-07 12:33:56 -05:00
topic_list_serializer.rb
topic_localization_serializer.rb
topic_pending_post_serializer.rb
topic_post_count_serializer.rb
topic_poster_serializer.rb
topic_timer_serializer.rb
topic_tracking_state_item_serializer.rb
topic_tracking_state_serializer.rb
topic_view_bookmark_serializer.rb FEATURE: Allow acting on all bookmarks in topic footer buttons (#39063) 2026-04-07 14:09:51 +10:00
topic_view_details_serializer.rb DEV: Improve banner topic permissions for read-restricted and unlisted topics (#38556) 2026-03-16 11:45:07 -05:00
topic_view_posts_serializer.rb
topic_view_serializer.rb FEATURE: Allow selection of multiple content languages when viewing topics and posts (#42128) 2026-07-30 12:19:44 +08:00
topic_view_wordpress_serializer.rb
trust_level3_requirements_serializer.rb
upload_serializer.rb DEV: Add video conversion support for chat messages (#36275) 2025-12-01 12:34:56 -07:00
upload_thumbnail_serializer.rb
user_action_serializer.rb
user_auth_token_serializer.rb
user_badge_serializer.rb
user_badges_serializer.rb
user_bookmark_base_serializer.rb
user_bookmark_list_serializer.rb
user_card_serializer.rb FIX: Staged-user email disclosure to moderators via UserCardSerializer (#41993) 2026-07-23 13:47:48 -05:00
user_export_serializer.rb
user_field_serializer.rb FEATURE: Allow hiding user fields on signup form (#34672) 2025-09-15 10:42:07 +08:00
user_history_serializer.rb FEATURE: Link staff action log entries to originating reviewable (#39519) 2026-04-30 09:15:45 +08:00
user_name_serializer.rb
user_notification_schedule_serializer.rb
user_notification_total_serializer.rb
user_option_serializer.rb FEATURE: Allow selection of multiple content languages when viewing topics and posts (#42128) 2026-07-30 12:19:44 +08:00
user_post_bookmark_serializer.rb FIX: Bookmarked hidden post excerpts leak to unauthorized bookmark owners (#39873) 2026-05-15 14:04:05 +10:00
user_post_topic_bookmark_base_serializer.rb FEATURE: Localize topic titles in notifications and bookmarks (#34059) 2025-08-05 12:12:22 +08:00
user_serializer.rb FEATURE: User API key device authorization flow (#40189) 2026-06-10 16:09:44 -04:00
user_status_serializer.rb
user_summary_serializer.rb
user_tag_notifications_serializer.rb
user_topic_bookmark_serializer.rb FIX: Bookmarked hidden post excerpts leak to unauthorized bookmark owners (#39873) 2026-05-15 14:04:05 +10:00
user_with_custom_fields_serializer.rb
user_wordpress_serializer.rb
watched_word_list_serializer.rb FIX: unify watched word boundary regex across Ruby and JS engines (#37965) 2026-02-23 16:30:10 +01:00
watched_word_serializer.rb FIX: unify watched word boundary regex across Ruby and JS engines (#37965) 2026-02-23 16:30:10 +01:00
web_hook_category_serializer.rb
web_hook_event_type_serializer.rb
web_hook_flag_serializer.rb
web_hook_group_serializer.rb
web_hook_group_user_serializer.rb
web_hook_like_serializer.rb
web_hook_post_serializer.rb
web_hook_topic_view_serializer.rb
web_hook_user_serializer.rb
wizard_field_choice_serializer.rb UX: One step wizard (#36082) 2025-11-25 13:35:32 -05:00
wizard_field_serializer.rb UX: One step wizard (#36082) 2025-11-25 13:35:32 -05:00
wizard_serializer.rb
wizard_step_serializer.rb UX: One step wizard (#36082) 2025-11-25 13:35:32 -05:00