0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-08 17:53:55 +08:00
discourse/spec/serializers
Chris Alberti bd15d025b2
SECURITY: Enforce first-post visibility for topic bookmarks (#42321)
## Summary

Topic bookmark creation, listing, search, and reminder eligibility now
require the first post to be visible to the user. The fix adds an inner
join on the first post with hidden-post filtering to the list query and
delegates creation and visibility checks to `guardian.can_see_post?` on
the first post, preventing an authenticated user from bookmarking a
topic or searching its metadata after the first post is hidden.

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/1530

Co-authored-by: discourse-patch-triage
<272280883+discourse-patch-triage[bot]@users.noreply.github.com>
2026-08-05 12:52:40 -05:00
..
concerns FEATURE: Prevent silenced users from liking and using reactions (#37040) 2026-01-13 13:59:57 +01:00
about_serializer_spec.rb FEATURE: Localizable /about page fields via its settings page (#41123) 2026-06-26 20:41:08 +08:00
admin_category_serializer_spec.rb FEATURE: Category management UI for admins (#41218) 2026-07-15 09:17:25 +10:00
admin_detailed_user_serializer_spec.rb DEV: External IDs, and hidden groups to admins only. Allow moderators to see SSO when the moderators_view_sso_details site setting is enabled (#41496) 2026-08-03 11:25:34 -05:00
admin_plugin_serializer_spec.rb DEV: Enable Rails/FilePath rubocop rule (#40097) 2026-05-19 19:07:54 +02:00
admin_user_action_serializer_spec.rb
admin_user_list_serializer_spec.rb DEV: Prefer RSpec primitives for test setup (#42122) 2026-07-30 11:17:22 +08:00
auth_provider_serializer_spec.rb
basic_group_serializer_spec.rb
basic_group_user_serializer_spec.rb
basic_post_serializer_spec.rb
basic_reviewable_flagged_post_serializer_spec.rb
basic_reviewable_queued_post_serializer_spec.rb
basic_reviewable_serializer_spec.rb
basic_reviewable_user_serializer_spec.rb
basic_topic_serializer_spec.rb
basic_user_serializer_spec.rb
category_detailed_serializer_spec.rb
category_serializer_spec.rb SECURITY: Stop exposing hidden tag names through category serializers 2026-07-28 16:40:22 +02:00
category_upload_serializer_spec.rb
color_scheme_serializer_spec.rb
component_index_serializer_spec.rb
current_user_serializer_spec.rb FEATURE: Allow selection of multiple content languages when viewing topics and posts (#42128) 2026-07-30 12:19:44 +08:00
detailed_user_badge_serializer_spec.rb
directory_item_serializer_spec.rb SECURITY: /directory_items leaks restricted user-field values (#41476) 2026-07-06 13:05:48 -05:00
emoji_serializer_spec.rb
flag_serializer_spec.rb
flagged_user_serializer_spec.rb SECURITY: Hide IP from flagged regular users 2026-03-19 15:21:28 +00:00
found_user_serializer_spec.rb
group_show_serializer_spec.rb FIX: Ensure moderators do not clear group email domain (#39631) 2026-04-29 14:32:38 +08:00
group_user_serializer_spec.rb
group_user_with_custom_fields_serializer_spec.rb
incoming_email_details_serializer_spec.rb
incoming_email_serializer_spec.rb
invite_serializer_spec.rb SECURITY: Prevent expired invite details from leaking (#41184) 2026-06-25 22:01:51 +08:00
listable_topic_serializer_spec.rb
nested_replies_basic_category_serializer_spec.rb FEATURE: Add nested replies category conversion (#41236) 2026-07-06 08:22:22 -05:00
new_post_result_serializer_spec.rb
notification_serializer_spec.rb
pending_post_serializer_spec.rb
post_action_type_serializer_spec.rb
post_item_excerpt_spec.rb FIX: Handle Nokogiri HTML parser limits in PrettyText.excerpt (#37610) 2026-02-06 22:00:54 +01:00
post_localization_serializer_spec.rb
post_revision_serializer_spec.rb FIX: Omit inaccessible reply target post numbers from post revision history (#41547) 2026-07-08 11:41:43 -05:00
post_serializer_spec.rb FEATURE: Allow selection of multiple content languages when viewing topics and posts (#42128) 2026-07-30 12:19:44 +08:00
poster_serializer_spec.rb
remote_theme_serializer_spec.rb
reviewable_claimed_topic_serializer_spec.rb
reviewable_flagged_post_serializer_spec.rb FIX: Show translated post in review queue when present (#40378) 2026-05-29 14:32:11 -04:00
reviewable_note_serializer_spec.rb
reviewable_queued_post_serializer_spec.rb SECURITY: Restrict raw email in queued post payloads 2026-05-19 00:26:04 +01:00
reviewable_score_serializer_spec.rb FIX: Preserve safe formatting in reviewable reasons (#42164) 2026-07-30 17:07:08 +02:00
reviewable_serializer_spec.rb FIX: Reviewable Insights Metadata (#42145) 2026-08-05 10:02:27 -05:00
reviewable_user_serializer_spec.rb FEATURE: Allow suspending and silencing users from the review queue (#42205) 2026-07-31 14:47:40 +02:00
sidebar_section_serializer_spec.rb DEV: Prefer RSpec primitives for test setup (#42122) 2026-07-30 11:17:22 +08:00
single_sign_on_record_serializer_spec.rb
site_category_serializer_spec.rb SECURITY: Stop exposing hidden tag names through category serializers 2026-07-28 16:40:22 +02:00
site_serializer_spec.rb SECURITY: Stop exposing hidden tag names through category serializers 2026-07-28 16:40:22 +02:00
suggested_topic_serializer_spec.rb FIX: Suggested topic links to nested replies topics (#40302) 2026-05-26 08:40:38 -05:00
tag_group_serializer_spec.rb DEV: Move canonical tag routes to /tag/slug/id keeping /tag/name support (#37055) 2026-02-11 10:21:19 +08:00
tag_serializer_spec.rb FEATURE: Show localized tags (#37044) 2026-02-12 18:06:14 +08:00
theme_index_serializer_spec.rb FEATURE: enhance screenshot support for themes with dark/light modes (#36422) 2025-12-10 11:23:21 +10:00
theme_objects_setting_metadata_serializer_spec.rb DEV: Enable Rails/FilePath rubocop rule (#40097) 2026-05-19 19:07:54 +02:00
theme_serializer_spec.rb FEATURE: enhance screenshot support for themes with dark/light modes (#36422) 2025-12-10 11:23:21 +10:00
theme_settings_serializer_spec.rb DEV: Add disallowed_groups to theme/component settings (#41792) 2026-07-20 09:28:52 +10:00
topic_link_serializer_spec.rb FIX: Filter orphaned TopicLinks and normalize http URLs to https (#37098) 2026-01-15 12:12:34 +08:00
topic_list_item_serializer_spec.rb FEATURE: Notification/tracking changes for nested replies (#39750) 2026-05-07 12:33:56 -05:00
topic_list_serializer_spec.rb FEATURE: Show localized tags (#37044) 2026-02-12 18:06:14 +08:00
topic_tracking_state_item_serializer_spec.rb FIX: Don't emit tag names/slugs in topic tracking state (#40117) 2026-05-19 05:07:17 +08:00
topic_tracking_state_serializer_spec.rb
topic_view_details_serializer_spec.rb
topic_view_posts_serializer_spec.rb
topic_view_serializer_spec.rb DEV: Remove per topic toggle (#40869) 2026-06-15 18:43:36 +08:00
upload_serializer_spec.rb
user_auth_token_serializer_spec.rb DEV: Enable Rails/FilePath rubocop rule (#40097) 2026-05-19 19:07:54 +02:00
user_badge_serializer_spec.rb
user_bookmark_list_serializer_spec.rb SECURITY: Enforce first-post visibility for topic bookmarks (#42321) 2026-08-05 12:52:40 -05:00
user_card_serializer_spec.rb DEV: Tighten featured topic serialization data (#40549) 2026-06-03 16:32:52 -05:00
user_export_serializer_spec.rb
user_notification_total_serializer_spec.rb
user_post_bookmark_serializer_spec.rb
user_serializer_spec.rb FEATURE: Allow selection of multiple content languages when viewing topics and posts (#42128) 2026-07-30 12:19:44 +08:00
user_status_serializer_spec.rb
user_summary_serializer_spec.rb
user_with_custom_fields_serializer_spec.rb
web_hook_post_serializer_spec.rb
web_hook_topic_view_serializer_spec.rb
web_hook_user_serializer_spec.rb DEV: Tighten featured topic serialization data (#40549) 2026-06-03 16:32:52 -05:00
wizard_serializer_spec.rb