Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-07 13:19:19 +08:00
Code Packages Activity Actions
discourse/spec/requests/admin
History
Exact
Juan David Martínez Cubillos 1dd0603581
 FIX: Validate and safely handle malformed embed allowlist regexes (#42327) 
## Summary

EmbeddableHost allowed_paths values are stored as regular expression
source and compiled during request handling without validation or error
handling. Now new or updated allowlists are validated on save, and
legacy invalid or timed-out patterns are safely skipped as non-matches
rather than causing HTTP 500 errors on public embed endpoints. This
prevents an administrator from accidentally breaking embed functionality
across their site.

## Source

- Patch Triage: `patch-triage/1556`

Co-authored-by: discourse-patch-triage
<272280883+discourse-patch-triage[bot]@users.noreply.github.com>
2026-08-05 12:54:43 -05:00
..
config FIX: Restrict upcoming-changes toggle to registered upcoming-change settings (#42175) 2026-07-30 09:28:04 -05:00
admin_controller_spec.rb
api_controller_spec.rb FIX: Prevent read-only keys being created without scopes (#42280) 2026-08-03 15:45:48 -05:00
backups_controller_spec.rb FIX: Validate resumableFilename in check_backup_chunk to prevent path traversa... (#42098) 2026-07-28 11:18:14 -05:00
badges_controller_spec.rb FEATURE: Add a granular API key scope to list badges (#41086) 2026-06-22 18:32:02 +02:00
color_schemes_controller_spec.rb
dashboard_controller_spec.rb PERF: parallelize report fetching in the dashboard Reports section (#42252) 2026-08-05 18:29:17 +03:00
email_controller_spec.rb FIX: Render hashtag slugs as text nodes in Email::Styles (#42352) 2026-08-05 09:08:24 -05:00
email_logs_controller_spec.rb
email_styles_controller_spec.rb DEV: Enable Rails/FilePath rubocop rule (#40097) 2026-05-19 19:07:54 +02:00
email_templates_controller_spec.rb DEV: Remove unnecessary TranslationOverride.delete_all in specs (#40131) 2026-05-19 15:08:24 +02:00
embeddable_hosts_controller_spec.rb FIX: Validate and safely handle malformed embed allowlist regexes (#42327) 2026-08-05 12:54:43 -05:00
embedding_controller_spec.rb
emojis_controller_spec.rb UX: Better admin emoji page sorting & filtering and service refactors (#41892) 2026-07-24 12:01:21 +10:00
form_templates_controller_spec.rb FIX: Form templates page returning 500 error (#39799) 2026-05-06 18:53:52 +02:00
groups_controller_spec.rb UX: Normalize automatic membership email domains (#41434) 2026-07-03 17:22:18 +02:00
impersonate_controller_spec.rb FEATURE: Impersonation countdown (#39871) 2026-05-12 12:12:25 +08:00
onboarding_events_controller_spec.rb FEATURE: Log staff actions for admin onboarding panel steps (#42032) 2026-07-24 14:43:01 -07:00
permalinks_controller_spec.rb
plugins_controller_spec.rb DEV: Enable Rails/FilePath rubocop rule (#40097) 2026-05-19 19:07:54 +02:00
problem_checks_controller_spec.rb FEATURE: Add problem checks page to admin panel and allow ignoring problem checks (#39103) 2026-04-23 08:28:33 +08:00
reports_controller_spec.rb DEV: Remove reporting_improvements upcoming change (#41259) 2026-07-01 07:52:02 +08:00
robots_txt_controller_spec.rb FIX: Log changes to robots.txt by admins (#37901) 2026-02-18 14:20:21 -05:00
screened_emails_controller_spec.rb FIX: Screened email list exposes IP addresses to moderators without IP-view permission (#39875) 2026-05-11 14:47:17 +08:00
screened_ip_addresses_controller_spec.rb DEV: Require admin for allow_admin screened IP mutations (#38545) 2026-03-12 10:43:19 -07:00
screened_urls_controller_spec.rb
search_controller_spec.rb DEV: Refactor admin search index into a service (#38959) 2026-04-01 10:09:10 +10:00
search_logs_spec.rb UX: Focus dashboard search analytics on member searches (#41647) 2026-07-13 12:41:19 +08:00
site_settings_controller_spec.rb UX: Link to required settings from language switcher validation error (#38374) 2026-07-16 15:51:06 -04:00
site_texts_controller_spec.rb DEV: Enable Style/RedundantParentheses rubocop rule (#40095) 2026-05-19 15:48:09 +02:00
staff_action_logs_controller_spec.rb FEATURE: add bootstrap first admin job (#39851) 2026-05-08 16:16:18 -03:00
themes_controller_spec.rb DEV: Improve handling of private theme installs (#41845) 2026-07-24 13:42:41 -04:00
unknown_reviewables_controller_spec.rb
user_fields_controller_spec.rb DEV: add input=date type to custom user field options (#37902) 2026-02-19 07:04:52 +01:00
users_controller_spec.rb FIX: Prevent moderators from deleting peer moderators (#42248) 2026-08-04 09:45:57 -03:00
versions_controller_spec.rb
watched_words_controller_spec.rb DEV: Don't rely on ObjectSpace in a watched words spec (#39717) 2026-05-05 12:21:41 +02:00
web_hooks_controller_spec.rb FIX: Allow selecting tags when creating or editing webhooks (#37942) 2026-02-20 23:00:50 +08:00