Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-04 10:39:43 +08:00
Code Packages Activity Actions
discourse/spec/requests
History
Exact
Mark VanLandingham 7c82423416
 FIX: Prevent read-only keys being created without scopes (#42280) 
## Summary

Prevent read-only API keys from being created without scopes, which
previously granted them unscoped access. This was already enforced for
Api keys created via the UI. The fix enforces a mandatory 'global:read'
scope for read-only keys at the model and API levels, and includes a
migration to revoke existing invalid keys.

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/1192
2026-08-03 15:45:48 -05:00
..
admin FIX: Prevent read-only keys being created without scopes (#42280) 2026-08-03 15:45:48 -05:00
api FEATURE: Allow selection of multiple content languages when viewing topics and posts (#42128) 2026-07-30 12:19:44 +08:00
examples
about_controller_spec.rb FEATURE: Allow selection of multiple content languages when viewing topics and posts (#42128) 2026-07-30 12:19:44 +08:00
access_control_lists_controller_spec.rb FEATURE: Support users in DAccessControl and backend (#41358) 2026-07-15 09:18:06 +10:00
anonymous_actions_controller_spec.rb FEATURE: Prompt anonymous users to sign up after engagement clicks (#40256) 2026-05-26 09:30:38 +02:00
application_controller_spec.rb FIX: Prevent browsers from restoring stale documents in bfcache mode (#42207) 2026-07-31 17:24:47 +02:00
associate_accounts_controller_spec.rb
badges_controller_spec.rb FEATURE: Add a granular API key scope to list badges (#41086) 2026-06-22 18:32:02 +02:00
bookmarks_controller_spec.rb
calendar_subscriptions_controller_spec.rb
categories_controller_spec.rb SECURITY: Limit Category search term and word count (#41588) 2026-07-31 19:14:35 -05:00
clicks_controller_spec.rb SECURITY: Missing visibility check in click tracking endpoint (#41140) 2026-06-24 15:15:56 +10:00
composer_controller_spec.rb SECURITY: Respect group member visibility for counts (#41403) 2026-07-06 12:48:06 +08:00
composer_messages_controller_spec.rb SECURITY: Duplicate lookup reveals restricted topic titles through canonicalized URLs 2026-07-28 16:40:22 +02:00
crawler_hreflang_spec.rb UX: Prevent incomplete crawler localization settings (#41297) 2026-07-01 12:13:22 +08:00
default_headers_spec.rb
dev_mode_controller_spec.rb
directory_columns_controller_spec.rb
directory_items_controller_spec.rb SECURITY: Private UserField value disclosure via directory_items order sort side-channel (#41598) 2026-07-09 21:52:51 -05:00
discourse_id_controller_spec.rb
do_not_disturb_controller_spec.rb
drafts_controller_spec.rb FIX: DraftSerializer leaks real names of topic and post authors (#42197) 2026-07-31 09:17:27 -05:00
edit_directory_columns_controller_spec.rb
email_controller_spec.rb
embed_controller_spec.rb SECURITY: HTML injection in PrettyText.format_for_email from cooked-attribute reparsing 2026-07-31 22:01:37 +01:00
emojis_controller_spec.rb FEATURE: Locale-specific emoji search aliases (#39089) 2026-04-06 14:08:46 -03:00
exceptions_controller_spec.rb
export_csv_controller_spec.rb FIX: Race condition allows bypass of data export rate limit in Discourse (#41990) 2026-07-29 13:04:18 -05:00
extra_locales_controller_spec.rb
finish_installation_controller_spec.rb
form_templates_controller_spec.rb SECURITY: Scope form template endpoints to accessible categories 2026-05-19 00:26:04 +01:00
forums_controller_spec.rb
gifs_controller_spec.rb FIX: move klipy gifs request to backend (#41540) 2026-07-08 17:18:42 +04:00
groups_controller_spec.rb FIX: Restrict group SMTP settings updates to administrators (#42278) 2026-08-03 15:08:53 -05:00
hashtags_controller_spec.rb
highlightjs_controller_spec.rb
home_page_controller_spec.rb FEATURE: Allow fallback home routes for crawlers for custom homepage sites (#41234) 2026-06-29 09:57:40 -04:00
inline_onebox_controller_spec.rb SECURITY: Check topic visibility in Oneboxer even when categories match 2026-03-31 15:12:45 +01:00
invites_controller_spec.rb FIX: Allow logged-in users to redeem invites when new registrations are disabled (#42026) 2026-07-25 17:02:30 +02:00
list_controller_spec.rb FIX: Enforce public profile visibility in Guardian (#42274) 2026-08-03 13:59:32 -05:00
metadata_controller_spec.rb FEATURE: Accept shared files via the Web Share Target (#41030) 2026-06-18 17:35:09 -03:00
nested_topics_controller_spec.rb FIX: Add small action controls to nested activity log (#42108) 2026-07-29 10:19:47 -05:00
net_http_header_spec.rb
net_http_timeout_spec.rb
noscript_escape_spec.rb
notifications_controller_spec.rb FIX: Gate notification acting_user_name on enable_names setting (#42234) 2026-07-31 14:25:31 -05:00
offline_controller_spec.rb
omniauth_callbacks_controller_spec.rb FEATURE: Allow HTML for OAuth error message (#41204) 2026-06-26 08:35:06 -05:00
onebox_controller_spec.rb FIX: Local user onebox bypasses profile visibility checks and exposes hidden profile data (#42239) 2026-07-31 15:06:41 -05:00
permalinks_controller_spec.rb
post_action_users_controller_spec.rb UX: Ignored users reactions/likes should not show up (#39672) 2026-05-11 15:32:29 -03:00
post_actions_controller_spec.rb
post_localizations_controller_spec.rb UX: Allow user to set post and topic title language when manually creating post translations in modal (#41734) 2026-07-16 10:43:39 +08:00
post_readers_controller_spec.rb SECURITY: Missing post-level authorization allows whisper metadata disclosure 2026-03-31 15:12:45 +01:00
posts_controller_spec.rb FIX: Enforce public profile visibility in Guardian (#42274) 2026-08-03 13:59:32 -05:00
presence_controller_spec.rb
published_pages_controller_spec.rb SECURITY: Leakage of hidden tags to unauthorized users (#42218) 2026-07-31 10:53:38 -05:00
push_notification_controller_spec.rb
qunit_controller_spec.rb
reviewable_claimed_topics_controller_spec.rb SECURITY: Require topic visibility for category group moderator actions 2026-05-19 00:26:04 +01:00
reviewable_notes_controller_spec.rb
reviewables_controller_spec.rb FEATURE: Allow suspending and silencing users from the review queue (#42205) 2026-07-31 14:47:40 +02:00
robots_txt_controller_spec.rb
safe_mode_controller_spec.rb
search_controller_spec.rb FEATURE: Allow selection of multiple content languages when viewing topics and posts (#42128) 2026-07-30 12:19:44 +08:00
session_controller_spec.rb UX: Improve password manager and full name handling in code login (#41746) 2026-07-15 10:43:03 -07:00
sidebar_sections_controller_spec.rb FIX: Enforce per-section sidebar link cap on partial sidebar section updates (#42277) 2026-08-03 14:52:12 -05:00
similar_topics_controller_spec.rb
site_controller_spec.rb SECURITY: Anonymous sidebar serialization exposes descriptions of category-restricted tags 2026-07-28 16:40:22 +02:00
sitemap_controller_spec.rb
slugs_controller_spec.rb
static_controller_spec.rb FIX: Localize static topic pages … (#41260) 2026-06-29 21:34:17 +08:00
steps_controller_spec.rb
stylesheets_controller_spec.rb DEV: Drop empty core mobile/desktop stylesheets (#41988) 2026-07-23 20:30:13 +01:00
svg_sprite_controller_spec.rb
tag_groups_controller_spec.rb FIX: Prevent tag group from saving if private + no group selected (#39599) 2026-04-29 12:10:45 +08:00
tag_localizations_controller_spec.rb
tags_controller_spec.rb FIX: Gate permalink fallback redirects (#42224) 2026-07-31 12:39:09 -05:00
theme_import_map_spec.rb DEV: Improve cross-plugin/theme import handling (#40939) 2026-06-30 16:11:38 +01:00
theme_javascripts_controller_spec.rb PERF: Move theme settings from js bundle to preload data (#40137) 2026-06-08 16:04:56 +01:00
topic_localizations_controller_spec.rb UX: Allow user to set post and topic title language when manually creating post translations in modal (#41734) 2026-07-16 10:43:39 +08:00
topic_view_stats_controller_spec.rb
topics_controller_spec.rb FIX: Filter unlinked topic visibility in topic-link reflect queries (#42195) 2026-07-31 10:02:19 -05:00
uploads_controller_multisite_spec.rb
uploads_controller_spec.rb FIX: Serve inline-safe uploads inline on the local file store (#40739) 2026-07-14 18:52:35 +01:00
user_actions_controller_spec.rb FIX: Enforce public profile visibility in Guardian (#42274) 2026-08-03 13:59:32 -05:00
user_api_key_clients_controller_spec.rb
user_api_keys_controller_spec.rb Revert "FIX: Only allow OTPs to be generated from a browser session (#40964)" (#41875) 2026-07-22 18:18:02 +03:00
user_avatars_controller_spec.rb SECURITY: Improve SVG sanitization 2026-06-30 16:10:52 +02:00
user_badges_controller_spec.rb FIX: Enforce public profile visibility in Guardian (#42274) 2026-08-03 13:59:32 -05:00
user_status_controller_spec.rb FIX: Post serialization exposes hidden-profile user status messages (#40885) 2026-06-15 09:25:47 -05:00
users_controller_spec.rb DEV: External IDs, and hidden groups to admins only. Allow moderators to see SSO when the moderators_view_sso_details site setting is enabled (#41496) 2026-08-03 11:25:34 -05:00
users_email_controller_spec.rb DEV: CSRF Token Not Invalidated After Password Reset (#40998) 2026-06-17 16:07:30 -04:00
webhooks_controller_spec.rb SECURITY: Prevent any signed AWS SNS TopicARN from being accepted via webhooks 2026-06-30 16:10:52 +02:00
wizard_controller_spec.rb