Exact

Exact Union RegExp

Juan David Martínez Cubillos 54ed0fa270 DEV: External IDs, and hidden groups to admins only. Allow moderators to see SSO when the moderators_view_sso_details site setting is enabled (#41496) ... #### Description Moderators could access admin-only SSO, external identity and hidden groups data via GET /admin/users/:id.json — the single_sign_on_record field, external_ids field and hidden groups were serialized unconditionally for all staff members instead of being restricted to admins. This PR restricts External IDs, and hidden group to admins only but allows moderators to see SSO information when the `moderators_view_sso_details` SiteSetting is enabled Context: `t/180409`		2026-08-03 11:25:34 -05:00
..
admin	FIX: Validate resumableFilename in check_backup_chunk to prevent path traversa... (#42098)	2026-07-28 11:18:14 -05:00
users	FEATURE: Allow HTML for OAuth error message (#41204)	2026-06-26 08:35:06 -05:00
about_controller.rb	FEATURE: Allow selection of multiple content languages when viewing topics and posts (#42128)	2026-07-30 12:19:44 +08:00
access_control_lists_controller.rb	FEATURE: Support users in DAccessControl and backend (#41358)	2026-07-15 09:18:06 +10:00
anonymous_actions_controller.rb	FEATURE: Prompt anonymous users to sign up after engagement clicks (#40256)	2026-05-26 09:30:38 +02:00
application_controller.rb	FIX: Gate permalink fallback redirects (#42224)	2026-07-31 12:39:09 -05:00
associated_groups_controller.rb
badges_controller.rb	FIX: Non-listable and disabled badges exposed via XHR JSON requests (#37869)	2026-02-17 16:17:01 +11:00
bookmarks_controller.rb
calendar_subscriptions_controller.rb	FEATURE: Add calendar subscription URLs to user preferences (#38598)	2026-03-17 10:28:20 -03:00
categories_controller.rb	SECURITY: Limit Category search term and word count (#41588)	2026-07-31 19:14:35 -05:00
clicks_controller.rb	SECURITY: Missing visibility check in click tracking endpoint (#41140)	2026-06-24 15:15:56 +10:00
composer_controller.rb	SECURITY: Respect group member visibility for counts (#41403)	2026-07-06 12:48:06 +08:00
composer_messages_controller.rb	SECURITY: Whisper metadata disclosure via stale TopicLinks (#41139)	2026-06-24 14:44:27 +10:00
dev_mode_controller.rb	DEV: Add /dev-mode endpoint for MiniProfiler auth cookie (#37027)	2026-01-12 10:01:20 +08:00
directory_columns_controller.rb
directory_items_controller.rb	SECURITY: Private UserField value disclosure via directory_items order sort side-channel (#41598)	2026-07-09 21:52:51 -05:00
do_not_disturb_controller.rb
drafts_controller.rb	FIX: Drafts/reviewables API returned 404 when acting on own resource (#39449)	2026-05-26 09:29:20 +02:00
edit_directory_columns_controller.rb	DEV: Enable Style/RedundantParentheses rubocop rule (#40095)	2026-05-19 15:48:09 +02:00
email_controller.rb
embed_controller.rb	FIX: Add visibility check to Embed info (#40896)	2026-06-15 10:20:56 -05:00
emojis_controller.rb	FEATURE: Add emoji_picker_pinned_groups for pinning groups in the picker (#41881)	2026-07-22 09:51:15 -07:00
exceptions_controller.rb
export_csv_controller.rb	FIX: Race condition allows bypass of data export rate limit in Discourse (#41990)	2026-07-29 13:04:18 -05:00
extra_locales_controller.rb	DEV: Refactor locale bundle loading (#37114)	2026-01-16 11:45:14 +00:00
finish_installation_controller.rb	DEV: Enable Style/RedundantBegin rubocop rule (#40096)	2026-05-19 18:44:54 +02:00
form_templates_controller.rb	SECURITY: Scope form template endpoints to accessible categories	2026-05-19 00:26:04 +01:00
forums_controller.rb
gifs_controller.rb	FIX: move klipy gifs request to backend (#41540)	2026-07-08 17:18:42 +04:00
groups_controller.rb	FIX: Make auto pseudogroups visible to logged on users (#41498)	2026-07-08 09:28:18 +10:00
hashtags_controller.rb
highlight_js_controller.rb
home_page_controller.rb
inline_onebox_controller.rb
invites_controller.rb	FIX: Allow logged-in users to redeem invites when new registrations are disabled (#42026)	2026-07-25 17:02:30 +02:00
list_controller.rb	FEATURE: explicit default homepage setting (#41785)	2026-07-22 16:22:19 -04:00
metadata_controller.rb	FEATURE: Accept shared files via the Web Share Target (#41030)	2026-06-18 17:35:09 -03:00
nested_topics_controller.rb	FIX: Add small action controls to nested activity log (#42108)	2026-07-29 10:19:47 -05:00
new_invite_controller.rb
new_topic_controller.rb
notifications_controller.rb	FIX: Hide badge notifications for disabled badges or when badges are disabled (#36987)	2026-01-07 15:28:43 +08:00
offline_controller.rb
onebox_controller.rb
permalinks_controller.rb	SECURITY: prevent permalink redirects from leaking restricted slugs	2026-01-28 17:11:14 +00:00
post_action_users_controller.rb	UX: Ignored users reactions/likes should not show up (#39672)	2026-05-11 15:32:29 -03:00
post_actions_controller.rb	SECURITY: fix is_warning type coercion bypass in PostActionsController	2026-03-19 15:21:28 +00:00
post_localizations_controller.rb	UX: Allow user to set post and topic title language when manually creating post translations in modal (#41734)	2026-07-16 10:43:39 +08:00
post_readers_controller.rb	SECURITY: Missing post-level authorization allows whisper metadata disclosure	2026-03-31 15:12:45 +01:00
posts_controller.rb	FIX: Restrict opening post type transitions to regular and moderator_action (#42221)	2026-07-31 13:55:20 -05:00
presence_controller.rb
published_pages_controller.rb	SECURITY: Leakage of hidden tags to unauthorized users (#42218)	2026-07-31 10:53:38 -05:00
push_notification_controller.rb
qunit_controller.rb	DEV: Rename EmberCli to EmberAssets (#40938)	2026-06-16 12:56:56 +02:00
reviewable_claimed_topics_controller.rb	DEV: Convert ReviewableClaimedTopicsController#destroy response from 403 to 404 (#38339)	2026-03-06 15:39:51 -06:00
reviewable_notes_controller.rb	SECURITY: scope reviewable notes to user-visible reviewables	2026-02-26 12:22:54 +00:00
reviewables_controller.rb	FIX: Drafts/reviewables API returned 404 when acting on own resource (#39449)	2026-05-26 09:29:20 +02:00
robots_txt_controller.rb	DEV: Replace JS build system with Rolldown (#35963)	2026-05-29 11:11:55 +01:00
safe_mode_controller.rb
search_controller.rb	FIX: exclude 't' shortcut from min length bypass (#37440)	2026-02-05 06:58:19 +11:00
session_controller.rb	UX: Improve password manager and full name handling in code login (#41746)	2026-07-15 10:43:03 -07:00
sidebar_sections_controller.rb	FIX: Base custom sidebar section translations on their source locale (#42027)	2026-08-03 17:49:42 +02:00
similar_topics_controller.rb	FEATURE: First iteration of nested replies (#38888)	2026-04-16 08:06:44 -05:00
site_controller.rb
sitemap_controller.rb
slugs_controller.rb
static_controller.rb	FIX: Localize static topic pages … (#41260)	2026-06-29 21:34:17 +08:00
steps_controller.rb
stylesheets_controller.rb	PERF: Only recompile stylesheets when required (#41735)	2026-07-16 12:14:28 +01:00
svg_sprite_controller.rb	DEV: Enable Style/RedundantParentheses rubocop rule (#40095)	2026-05-19 15:48:09 +02:00
tag_groups_controller.rb	FIX: Failed updates in tag group controller would be logged (#38333)	2026-03-06 17:11:12 -03:00
tag_localizations_controller.rb
tag_param_limit.rb	SECURITY: Reject too many tags during post creation (#41395)	2026-07-03 14:40:27 +08:00
tags_controller.rb	FIX: Gate permalink fallback redirects (#42224)	2026-07-31 12:39:09 -05:00
test_requests_controller.rb
theme_javascripts_controller.rb	DEV: Enable Rails/FilePath rubocop rule (#40097)	2026-05-19 19:07:54 +02:00
topic_localizations_controller.rb	UX: Allow user to set post and topic title language when manually creating post translations in modal (#41734)	2026-07-16 10:43:39 +08:00
topic_view_stats_controller.rb
topics_controller.rb	FIX: Authorize topic visibility before recording or deleting read timings (#42176)	2026-07-30 10:57:33 -05:00
uploads_controller.rb	FIX: Serve inline-safe uploads inline on the local file store (#40739)	2026-07-14 18:52:35 +01:00
user_actions_controller.rb	SECURITY: Enforce Guardian checks in UserActionsController#show	2026-03-19 15:21:28 +00:00
user_api_key_clients_controller.rb	FIX: Empty-scopes bypass allows untrusted client registration and downstream scope/redirect policy bypass (#37855)	2026-02-17 12:39:09 +11:00
user_api_keys_controller.rb	Revert "FIX: Only allow OTPs to be generated from a browser session (#40964)" (#41875)	2026-07-22 18:18:02 +03:00
user_avatars_controller.rb	SECURITY: Improve SVG sanitization	2026-06-30 16:10:52 +02:00
user_badges_controller.rb	SECURITY: Prevent badge lookup from exposing hidden profiles (#41160)	2026-06-25 13:01:03 +08:00
user_status_controller.rb
users_controller.rb	DEV: External IDs, and hidden groups to admins only. Allow moderators to see SSO when the moderators_view_sso_details site setting is enabled (#41496)	2026-08-03 11:25:34 -05:00
users_email_controller.rb	FIX: enforces login for create in user emails controller (#37770)	2026-02-12 17:10:43 +01:00
webhooks_controller.rb	SECURITY: Prevent any signed AWS SNS TopicARN from being accepted via webhooks	2026-06-30 16:10:52 +02:00
wizard_controller.rb