Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-06 13:08:40 +08:00
Code Packages Activity Actions
discourse/lib/guardian
History
Exact
Juan David Martínez Cubillos 54ed0fa270
 DEV: External IDs, and hidden groups to admins only. Allow moderators to see SSO when the moderators_view_sso_details site setting is enabled (#41496) 
#### Description

Moderators could access admin-only SSO, external identity and hidden
groups data via GET /admin/users/:id.json — the single_sign_on_record
field, external_ids field and hidden groups were serialized
unconditionally for all staff members instead of being restricted to
admins. This PR restricts External IDs, and hidden group to admins only
but allows moderators to see SSO information when the
`moderators_view_sso_details` SiteSetting is enabled

Context: `t/180409`
2026-08-03 11:25:34 -05:00
..
bookmark_guardian.rb DEV: Consistently use Guardian helper methods (#34024) 2025-08-14 15:23:42 +08:00
category_guardian.rb PERF: Speed up category visibility checks (#41977) 2026-07-24 07:53:49 +08:00
ensure_magic.rb
flag_guardian.rb FEATURE: allow edit custom flags (#32344) 2025-04-17 12:31:52 +08:00
group_guardian.rb FEATURE: Split setting for allowing mods to manage categories and groups (#35174) 2025-10-06 10:43:42 +03:00
invite_guardian.rb FEATURE: Allow inviting new users directly as admins (#41748) 2026-07-16 14:59:24 -07:00
localization_guardian.rb FIX: Base custom sidebar section translations on their source locale (#42027) 2026-08-03 17:49:42 +02:00
permalink_guardian.rb SECURITY: prevent permalink redirects from leaking restricted slugs 2026-01-28 17:11:14 +00:00
post_guardian.rb FIX: allow category group moderators to view edit history (#37876) 2026-07-24 16:29:06 +02:00
post_revision_guardian.rb
sidebar_guardian.rb
staff_action_log_guardian.rb SECURITY: Restrict staff action logs visibility for moderators 2026-01-28 17:11:14 +00:00
tag_guardian.rb FIX: Don't auto-remove chat members from logged_in_users group (#40543) 2026-06-03 18:15:32 +02:00
topic_guardian.rb SECURITY: Scope PM reviewables to their allowed audience 2026-07-28 16:40:22 +02:00
upload_guardian.rb FIX: Enforce secure-upload ACL in AI bot prompt path (#39903) 2026-05-13 09:55:32 +08:00
user_guardian.rb DEV: External IDs, and hidden groups to admins only. Allow moderators to see SSO when the moderators_view_sso_details site setting is enabled (#41496) 2026-08-03 11:25:34 -05:00