Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-06 09:05:23 +08:00
Code Packages Activity Actions
discourse/plugins/discourse-reactions/spec/requests
History
Exact
Isaac Janzen 76f0734c7a
 SECURITY: anonymous users can read hidden real names via reaction-user endpoints (#41931) 
## Summary

Fix anonymous disclosure of hidden full names of reactors and likers via
reaction-user APIs when `enable_names` setting is disabled. The
`CustomReactionsController` now conditionally includes the `name` field
only when `enable_names` is enabled, ensuring the invariant that hidden
full names are not exposed to unauthenticated users.

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/1451

Co-authored-by: discourse-patch-triage
<272280883+discourse-patch-triage[bot]@users.noreply.github.com>
2026-07-22 12:18:18 -05:00
..
custom_reactions_controller_custom_emoji_spec.rb FEATURE: Promote discourse_reactions_allow_any_emoji out of experimental (#35589) 2025-10-24 16:51:18 +10:00
custom_reactions_controller_spec.rb SECURITY: anonymous users can read hidden real names via reaction-user endpoints (#41931) 2026-07-22 12:18:18 -05:00
post_action_users_controller_spec.rb
topics_controller_spec.rb UX: Ignored users reactions/likes should not show up (#39672) 2026-05-11 15:32:29 -03:00