Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-06 01:10:43 +08:00
Code Packages Activity Actions
discourse/plugins/discourse-reactions
History
Exact
Isaac Janzen 76f0734c7a
 SECURITY: anonymous users can read hidden real names via reaction-user endpoints (#41931) 
## Summary

Fix anonymous disclosure of hidden full names of reactors and likers via
reaction-user APIs when `enable_names` setting is disabled. The
`CustomReactionsController` now conditionally includes the `name` field
only when `enable_names` is enabled, ensuring the invariant that hidden
full names are not exposed to unauthenticated users.

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/1451

Co-authored-by: discourse-patch-triage
<272280883+discourse-patch-triage[bot]@users.noreply.github.com>
2026-07-22 12:18:18 -05:00
..
app SECURITY: anonymous users can read hidden real names via reaction-user endpoints (#41931) 2026-07-22 12:18:18 -05:00
assets A11Y: ensure post avatars are hidden when paired with usernames (#41686) 2026-07-14 07:04:22 -04:00
config FEATURE: Bump enable_discourse_reactions_by_default upcoming change to stable (#41826) 2026-07-21 09:49:45 +10:00
db FEATURE: Promote discourse_reactions_allow_any_emoji out of experimental (#35589) 2025-10-24 16:51:18 +10:00
lib DEV: NameError when resolving reactions serializer helpers 2026-05-26 13:04:29 +08:00
public/images/upcoming_changes UX: post reply count position change (#39606) 2026-05-11 11:43:54 +04:00
spec SECURITY: anonymous users can read hidden real names via reaction-user endpoints (#41931) 2026-07-22 12:18:18 -05:00
test/javascripts FIX: close post reaction menu on route change (#41619) 2026-07-10 16:38:07 +04:00
package.json DEV: Add a script for generating external types in discourse-types (#37095) 2026-03-09 20:37:43 +01:00
plugin.rb FEATURE: Prompt anonymous users to sign up after engagement clicks (#40256) 2026-05-26 09:30:38 +02:00
README.md
tsconfig.json DEV: Add a script for generating external types in discourse-types (#37095) 2026-03-09 20:37:43 +01:00

README.md

Discourse Reactions

Discourse-reactions is a plugin that allows user to add their reactions to the post.

For more information, please see: https://meta.discourse.org/t/discourse-reactions-beyond-likes/183261