Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-06 13:08:40 +08:00
Code Packages Activity Actions
discourse/plugins/discourse-calendar/app/models
History
Exact
Chris Alberti c253fb0197
 SECURITY: Remove stale invitee access for users removed from invited groups on private events (#42187) 
## Summary

Correctly restrict private calendar event access to current group
members. The patch replaces stale invitee-row authorization with active
invited-group membership checks across event detail serialization,
attendance searches, RSVP mutations, and livestream chat metadata, and
prunes stale invitee records when a user is removed from a group.

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/1377

Co-authored-by: discourse-patch-triage
<272280883+discourse-patch-triage[bot]@users.noreply.github.com>
2026-07-30 15:15:46 -05:00
..
discourse_calendar UX: improve livestream chat messaging (#41750) 2026-07-21 11:07:31 +10:00
discourse_post_event SECURITY: Remove stale invitee access for users removed from invited groups on private events (#42187) 2026-07-30 15:15:46 -05:00
calendar_event.rb DEV: Enable Style/RedundantSelf rubocop rule (#40098) 2026-05-19 19:27:45 +02:00