Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-06 07:23:30 +08:00
Code Packages Activity Actions
discourse/plugins/discourse-subscriptions/app
History
Exact
Isaac Janzen ac2074474f
 SECURITY: Subscription contributors expose full user profile fields to anonymous viewers (#40891) 
## Summary

Correctly enforce profile visibility restrictions in the subscriptions
contributors endpoint and user serializers. This prevents the exposure
of sensitive profile fields—including bio, location, and website—to
anonymous viewers when public profiles are disabled via site settings.
The fix also hardens the user and user card serializers to omit profile
details for unauthorized scopes as a defense-in-depth measure.

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/1286

Co-authored-by: discourse-patch-triage
<272280883+discourse-patch-triage[bot]@users.noreply.github.com>
2026-06-15 10:24:06 -05:00
..
controllers SECURITY: Subscription contributors expose full user profile fields to anonymous viewers (#40891) 2026-06-15 10:24:06 -05:00
jobs
models/discourse_subscriptions DEV: Always pass --force to annotaterb and reorder annotations (#39977) 2026-05-13 14:12:48 +01:00
serializers/discourse_subscriptions DEV: Enable Style/RedundantBegin rubocop rule (#40096) 2026-05-19 18:44:54 +02:00
services/discourse_subscriptions DEV: Enable Style/RedundantBegin rubocop rule (#40096) 2026-05-19 18:44:54 +02:00