Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-08 17:53:55 +08:00
Code Packages Activity Actions
discourse/spec/services
History
Exact
Chris Alberti bd15d025b2
 SECURITY: Enforce first-post visibility for topic bookmarks (#42321) 
## Summary

Topic bookmark creation, listing, search, and reminder eligibility now
require the first post to be visible to the user. The fix adds an inner
join on the first post with hidden-post filtering to the list query and
delegates creation and visibility checks to `guardian.can_see_post?` on
the first post, preventing an authenticated user from bookmarking a
topic or searching its metadata after the first post is hidden.

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/1530

Co-authored-by: discourse-patch-triage
<272280883+discourse-patch-triage[bot]@users.noreply.github.com>
2026-08-05 12:52:40 -05:00
..
access_control_list FEATURE: Support users in DAccessControl and backend (#41358) 2026-07-15 09:18:06 +10:00
admin/search FIX: Enforce can_see_ip checks across admin IP features (#40019) 2026-05-19 11:37:20 +08:00
admin_notices FEATURE: Add problem checks page to admin panel and allow ignoring problem checks (#39103) 2026-04-23 08:28:33 +08:00
categories FIX: Don't reset customized site settings when new category (#41864) 2026-07-21 14:33:07 +08:00
category DEV: Refactor category hierarchical search (#37609) 2026-02-13 09:43:56 +01:00
custom_emoji UX: Better admin emoji page sorting & filtering and service refactors (#41892) 2026-07-24 12:01:21 +10:00
discourse_id
email_login_code UX: Improve password manager and full name handling in code login (#41746) 2026-07-15 10:43:03 -07:00
flags
groups DEV: Add descriptive error message when creating requestable group with no owner (#40391) 2026-05-29 11:11:59 +08:00
nested_topic FIX: Restore nested post moderation affordances (#41475) 2026-07-07 07:51:05 -05:00
notification/action
notifications DEV: Prefer RSpec primitives for test setup (#42122) 2026-07-30 11:17:22 +08:00
problem_check DEV: Restore landlock problem-check (#42172) 2026-07-30 15:13:37 +01:00
site_setting FIX: Hidden setting error when enabling plugin linked to UC (#42007) 2026-07-24 09:58:37 +10:00
site_setting_localizations/about_config FEATURE: Localizable /about page fields via its settings page (#41123) 2026-06-26 20:41:08 +08:00
tags FIX: Allow selecting tags that are only used in personal messages (#41918) 2026-07-24 12:27:03 +02:00
themes FEATURE: Enable high context topic cards in Horizon by default (#39959) 2026-05-15 10:50:42 +10:00
upcoming_changes FIX: Restrict upcoming-changes toggle to registered upcoming-change settings (#42175) 2026-07-30 09:28:04 -05:00
user FEATURE: Bulk suspend users and filter the admin users list by activation (#41227) 2026-06-29 11:26:34 +02:00
user_api_key FEATURE: User API key device authorization flow (#40189) 2026-06-10 16:09:44 -04:00
video_conversion FIX: Maintain rotation for video uploads to AWS (#41767) 2026-07-16 21:07:38 +08:00
access_control_list_manager_spec.rb DEV: Add banned_acl concept to AccessControlList (#41254) 2026-06-29 16:22:30 +10:00
admin_dashboard_engagement_spec.rb PERF: Serve the activity_by_category report from daily rollups (#42046) 2026-07-28 12:53:29 +08:00
admin_dashboard_highlights_spec.rb PERF: Use daily rollups for DAU/MAU reports (#41958) 2026-07-24 09:52:40 +08:00
admin_dashboard_search_spec.rb UX: Focus dashboard search analytics on member searches (#41647) 2026-07-13 12:41:19 +08:00
admin_dashboard_section_configuration_spec.rb FEATURE: Let plugins register persistable admin dashboard section settings (#41843) 2026-07-22 18:00:38 +03:00
admin_dashboard_section_loader_spec.rb FIX: Don't fail the dashboard when one section errors (#41720) 2026-07-15 17:20:51 +08:00
admin_dashboard_site_traffic_spec.rb FEATURE: Reclassify likely crawlers in site traffic reporting (#42199) 2026-08-04 10:08:53 +08:00
anonymous_shadow_creator_spec.rb DEV: Rename anonymous group to anonymous_users (#40435) 2026-06-02 09:29:46 +10:00
auto_silence_spec.rb
badge_granter_spec.rb DEV: Automatically detect and revert translation overrides in specs (#40003) 2026-05-13 22:09:23 +02:00
base_bookmarkable_spec.rb
category_hashtag_data_source_spec.rb FIX: Use unaccent() for category name/slug search (#37622) 2026-02-12 08:43:23 +01:00
color_scheme_revisor_spec.rb
destroy_task_spec.rb
email_settings_exception_handler_spec.rb
email_settings_validator_spec.rb
email_style_updater_spec.rb DEV: Enable Rails/FilePath rubocop rule (#40097) 2026-05-19 19:07:54 +02:00
external_upload_manager_spec.rb FIX: Run validation checks for heic, heif files before conversion (#42075) 2026-07-28 12:26:27 +08:00
flag_sockpuppets_spec.rb
group_action_logger_spec.rb PERF: Add Users to Group Improvements Pt. 2 (#38901) 2026-04-06 09:31:50 -05:00
group_mentions_updater_spec.rb FIX: Sync category description when post content changes outside PostRevisor (#39184) 2026-05-11 16:13:23 +02:00
group_message_spec.rb DEV: Enable Style/RedundantParentheses rubocop rule (#40095) 2026-05-19 15:48:09 +02:00
hashtag_autocomplete_service_spec.rb DEV: Move canonical tag routes to /tag/slug/id keeping /tag/name support (#37055) 2026-02-11 10:21:19 +08:00
heat_settings_updater_spec.rb
hub_push_notification_pusher_spec.rb DEV: Centralize push notification delivery into a single job (#39207) 2026-04-14 11:55:45 -03:00
inline_uploads_multisite_spec.rb
inline_uploads_spec.rb FIX: Prevent backslash accumulation in upload markdown labels (#39461) 2026-06-03 18:10:38 +02:00
list_admin_categories_spec.rb FEATURE: Category management UI for admins (#41218) 2026-07-15 09:17:25 +10:00
locale_normalizer_spec.rb
notification_emailer_spec.rb DEV: Prefer RSpec primitives for test setup (#42122) 2026-07-30 11:17:22 +08:00
post_action_notifier_spec.rb
post_alerter_spec.rb SECURITY: Replying to a whisper lets non-whisperers create staff-only whisper posts 2026-05-19 00:26:04 +01:00
post_bookmarkable_spec.rb
post_owner_changer_spec.rb SECURITY: Ensure moderator can see post/topic before allowing them to change owner 2026-01-28 17:11:14 +00:00
problem_check_spec.rb FIX: Clear disabled/deleted ProblemChecks automatically (#42243) 2026-07-31 21:18:28 +01:00
push_notification_pusher_spec.rb FIX: Clean up push subscriptions whose endpoint domain no longer resolves (#39804) 2026-05-06 14:37:58 -03:00
random_topic_selector_spec.rb
search_indexer_spec.rb FEATURE: Automatic AI captions (#41586) 2026-07-15 13:24:10 +08:00
sidebar_section_updater_spec.rb DEV: Prefer RSpec primitives for test setup (#42122) 2026-07-30 11:17:22 +08:00
sidebar_site_settings_backfiller_spec.rb
site_settings_spec.rb FIX: Reject DiscourseConnect SSO payloads when secret is blank (#40830) 2026-06-12 15:17:16 +03:00
staff_action_logger_spec.rb FEATURE: Localizable /about page fields via its settings page (#41123) 2026-06-26 20:41:08 +08:00
tag_hashtag_data_source_spec.rb FIX: Allow selecting tags that are only used in personal messages (#41918) 2026-07-24 12:27:03 +02:00
tag_settings_updater_spec.rb FIX: Clean localized tag names (#38488) 2026-03-12 12:54:50 +08:00
theme_settings_migrations_runner_spec.rb DEV: Add category helper for theme migration (#38816) 2026-03-24 16:50:37 +08:00
themes_spec.rb
topic_bookmarkable_spec.rb SECURITY: Enforce first-post visibility for topic bookmarks (#42321) 2026-08-05 12:52:40 -05:00
topic_status_updater_spec.rb FEATURE: Exclude small actions from topic counters and unread tracking (#40481) 2026-06-08 08:03:55 +02:00
topic_timestamp_changer_spec.rb
trust_level_granter_spec.rb
user_activator_spec.rb DEV: Change authenticated_with_oauth to use key instead of string. (#38381) 2026-03-10 18:31:32 -03:00
user_anonymizer_spec.rb FIX: Block associated account emails on user delete and anonymize (#37638) 2026-02-09 18:26:35 +01:00
user_authenticator_spec.rb
user_destroyer_spec.rb FIX: Ignore pending reviewables when their target user is deleted (#42335) 2026-08-05 13:51:45 +08:00
user_merger_spec.rb
user_notification_schedule_processor_spec.rb
user_password_expirer_spec.rb
user_silencer_spec.rb SECURITY: Stale featured rows expose unlisted topic content (#41810) 2026-07-17 09:19:08 -05:00
user_stat_count_updater_spec.rb
user_suspender_spec.rb FEATURE: Link staff action log entries to originating reviewable (#39519) 2026-04-30 09:15:45 +08:00
user_updater_spec.rb FIX: Ensure language header selections do not silently get added to 'Languages I understand' (#42294) 2026-08-04 14:46:41 +08:00
username_changer_spec.rb FIX: Preserve display name in quotes when using the rich text editor (#38078) 2026-02-26 21:04:07 +01:00
username_checker_service_spec.rb
wildcard_domain_checker_spec.rb
wildcard_url_checker_spec.rb DEV: Fix auth redirect validation in user API key flow (#40459) 2026-06-01 15:47:35 -04:00
word_watcher_spec.rb FIX: Watched word with invalid regex crashes markdown cook (#40107) 2026-05-18 16:04:20 +08:00