mirror of
https://github.com/discourse/discourse.git
synced 2026-08-06 02:51:10 +08:00
76f0734c7a## Summary Fix anonymous disclosure of hidden full names of reactors and likers via reaction-user APIs when `enable_names` setting is disabled. The `CustomReactionsController` now conditionally includes the `name` field only when `enable_names` is enabled, ensuring the invariant that hidden full names are not exposed to unauthenticated users. ## Source - Patch Triage: https://patch.discourse.org/patch-triage/1451 Co-authored-by: discourse-patch-triage <272280883+discourse-patch-triage[bot]@users.noreply.github.com> |
||
|---|---|---|
| .. | ||
| fabricators | ||
| lib | ||
| models | ||
| reports | ||
| requests | ||
| serializers | ||
| services | ||
| system | ||
| plugin_spec.rb | ||
