Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-06 04:48:33 +08:00
Code Packages Activity Actions
discourse/app/controllers
History
Exact
Alan Guo Xiang Tan b6b2a2e602
 SECURITY: Harden ListController top period query against SQL injection (#41718) 
A category's `default_top_period` was interpolated raw into the
top-topic
score predicate in `ListController` before the period was validated
against
the allowlist. For anonymous requests to a category whose default view
is
`top`, an attacker-planted value reached the SQL predicate directly. The
response never returns the query's data, but it changes depending on
whether
an injected condition holds, so an attacker can read data one yes/no
answer at
a time.

This is hardening rather than a critical fix because the column is
`varchar(20)`: PostgreSQL rejects an over-long value, leaving no room
for a
subquery or a second statement. An attacker could only probe one value
at a
time, for example reading the PostgreSQL session role character by
character,
not perform arbitrary reads or writes.

Harden the path in depth:

- Sanitise the category-derived period in `best_period_for`, falling
back to
the site default when it is not a known period, so the untrusted value
never
  reaches SQL.
- Build the score column in `best_period_with_topics_for` through the
validating `TopTopic.score_column_for_period` helper instead of raw
string
  interpolation.
- Clear `Category#default_top_period` on validation when it is not a
known
period, so an invalid value is never stored and the category falls back
to
  the site default at read time.
2026-07-15 12:17:50 +08:00
..
admin FEATURE: Category management UI for admins (#41218) 2026-07-15 09:17:25 +10:00
users FEATURE: Allow HTML for OAuth error message (#41204) 2026-06-26 08:35:06 -05:00
about_controller.rb FEATURE: Localizable /about page fields via its settings page (#41123) 2026-06-26 20:41:08 +08:00
access_control_lists_controller.rb FEATURE: Support users in DAccessControl and backend (#41358) 2026-07-15 09:18:06 +10:00
anonymous_actions_controller.rb FEATURE: Prompt anonymous users to sign up after engagement clicks (#40256) 2026-05-26 09:30:38 +02:00
application_controller.rb FEATURE: Category management UI for admins (#41218) 2026-07-15 09:17:25 +10:00
associated_groups_controller.rb
badges_controller.rb FIX: Non-listable and disabled badges exposed via XHR JSON requests (#37869) 2026-02-17 16:17:01 +11:00
bookmarks_controller.rb
calendar_subscriptions_controller.rb FEATURE: Add calendar subscription URLs to user preferences (#38598) 2026-03-17 10:28:20 -03:00
categories_controller.rb FEATURE: Add nested replies category conversion (#41236) 2026-07-06 08:22:22 -05:00
clicks_controller.rb SECURITY: Missing visibility check in click tracking endpoint (#41140) 2026-06-24 15:15:56 +10:00
composer_controller.rb SECURITY: Respect group member visibility for counts (#41403) 2026-07-06 12:48:06 +08:00
composer_messages_controller.rb SECURITY: Whisper metadata disclosure via stale TopicLinks (#41139) 2026-06-24 14:44:27 +10:00
dev_mode_controller.rb DEV: Add /dev-mode endpoint for MiniProfiler auth cookie (#37027) 2026-01-12 10:01:20 +08:00
directory_columns_controller.rb
directory_items_controller.rb SECURITY: Private UserField value disclosure via directory_items order sort side-channel (#41598) 2026-07-09 21:52:51 -05:00
do_not_disturb_controller.rb
drafts_controller.rb FIX: Drafts/reviewables API returned 404 when acting on own resource (#39449) 2026-05-26 09:29:20 +02:00
edit_directory_columns_controller.rb DEV: Enable Style/RedundantParentheses rubocop rule (#40095) 2026-05-19 15:48:09 +02:00
email_controller.rb
embed_controller.rb FIX: Add visibility check to Embed info (#40896) 2026-06-15 10:20:56 -05:00
emojis_controller.rb FEATURE: Locale-specific emoji search aliases (#39089) 2026-04-06 14:08:46 -03:00
exceptions_controller.rb
export_csv_controller.rb DEV: Enable Style/RedundantParentheses rubocop rule (#40095) 2026-05-19 15:48:09 +02:00
extra_locales_controller.rb DEV: Refactor locale bundle loading (#37114) 2026-01-16 11:45:14 +00:00
finish_installation_controller.rb DEV: Enable Style/RedundantBegin rubocop rule (#40096) 2026-05-19 18:44:54 +02:00
form_templates_controller.rb SECURITY: Scope form template endpoints to accessible categories 2026-05-19 00:26:04 +01:00
forums_controller.rb
gifs_controller.rb FIX: move klipy gifs request to backend (#41540) 2026-07-08 17:18:42 +04:00
groups_controller.rb FIX: Make auto pseudogroups visible to logged on users (#41498) 2026-07-08 09:28:18 +10:00
hashtags_controller.rb
highlight_js_controller.rb
home_page_controller.rb
inline_onebox_controller.rb
invites_controller.rb FEATURE: Prompt anonymous users to sign up after engagement clicks (#40256) 2026-05-26 09:30:38 +02:00
list_controller.rb SECURITY: Harden ListController top period query against SQL injection (#41718) 2026-07-15 12:17:50 +08:00
metadata_controller.rb FEATURE: Accept shared files via the Web Share Target (#41030) 2026-06-18 17:35:09 -03:00
nested_topics_controller.rb DEV: route nested view through topic route (#40820) 2026-06-15 11:42:20 -05:00
new_invite_controller.rb
new_topic_controller.rb
notifications_controller.rb FIX: Hide badge notifications for disabled badges or when badges are disabled (#36987) 2026-01-07 15:28:43 +08:00
offline_controller.rb
onebox_controller.rb
permalinks_controller.rb SECURITY: prevent permalink redirects from leaking restricted slugs 2026-01-28 17:11:14 +00:00
post_action_users_controller.rb UX: Ignored users reactions/likes should not show up (#39672) 2026-05-11 15:32:29 -03:00
post_actions_controller.rb SECURITY: fix is_warning type coercion bypass in PostActionsController 2026-03-19 15:21:28 +00:00
post_localizations_controller.rb FIX: Also check if user can see post or topic prior to letting them localize it (#36749) 2025-12-18 02:12:58 +08:00
post_readers_controller.rb SECURITY: Missing post-level authorization allows whisper metadata disclosure 2026-03-31 15:12:45 +01:00
posts_controller.rb SECURITY: Reject too many tags during post creation (#41395) 2026-07-03 14:40:27 +08:00
presence_controller.rb
published_pages_controller.rb FIX: ensures only staff can check slugs (#37846) 2026-02-16 18:23:46 +01:00
push_notification_controller.rb
qunit_controller.rb DEV: Rename EmberCli to EmberAssets (#40938) 2026-06-16 12:56:56 +02:00
reviewable_claimed_topics_controller.rb DEV: Convert ReviewableClaimedTopicsController#destroy response from 403 to 404 (#38339) 2026-03-06 15:39:51 -06:00
reviewable_notes_controller.rb SECURITY: scope reviewable notes to user-visible reviewables 2026-02-26 12:22:54 +00:00
reviewables_controller.rb FIX: Drafts/reviewables API returned 404 when acting on own resource (#39449) 2026-05-26 09:29:20 +02:00
robots_txt_controller.rb DEV: Replace JS build system with Rolldown (#35963) 2026-05-29 11:11:55 +01:00
safe_mode_controller.rb
search_controller.rb FIX: exclude 't' shortcut from min length bypass (#37440) 2026-02-05 06:58:19 +11:00
session_controller.rb DEV: Introduce enable_local_logins_via_code as an alpha upcoming change (#41624) 2026-07-10 10:19:27 -07:00
sidebar_sections_controller.rb FIX: raise 404 when sidebar section doesn't exist (#37675) 2026-02-10 15:47:49 +01:00
similar_topics_controller.rb FEATURE: First iteration of nested replies (#38888) 2026-04-16 08:06:44 -05:00
site_controller.rb
sitemap_controller.rb
slugs_controller.rb
static_controller.rb FIX: Localize static topic pages … (#41260) 2026-06-29 21:34:17 +08:00
steps_controller.rb
stylesheets_controller.rb DEV: Enable Style/RedundantBegin rubocop rule (#40096) 2026-05-19 18:44:54 +02:00
svg_sprite_controller.rb DEV: Enable Style/RedundantParentheses rubocop rule (#40095) 2026-05-19 15:48:09 +02:00
tag_groups_controller.rb FIX: Failed updates in tag group controller would be logged (#38333) 2026-03-06 17:11:12 -03:00
tag_localizations_controller.rb FEATURE: Introduce tag localizations with API, without UI yet (#36754) 2025-12-18 18:25:58 +08:00
tag_param_limit.rb SECURITY: Reject too many tags during post creation (#41395) 2026-07-03 14:40:27 +08:00
tags_controller.rb FIX: Ensure /tag/bad-slug/:id/edit routes to edit page (#41115) 2026-06-23 18:58:50 +08:00
test_requests_controller.rb
theme_javascripts_controller.rb DEV: Enable Rails/FilePath rubocop rule (#40097) 2026-05-19 19:07:54 +02:00
topic_localizations_controller.rb UX: Use inline title editor instead of composer when editing translation (#36847) 2025-12-24 00:56:36 +08:00
topic_view_stats_controller.rb
topics_controller.rb SECURITY: detailed_404 Security Setting Bypassed (#41549) 2026-07-09 10:58:07 -05:00
uploads_controller.rb FIX: Serve inline-safe uploads inline on the local file store (#40739) 2026-07-14 18:52:35 +01:00
user_actions_controller.rb SECURITY: Enforce Guardian checks in UserActionsController#show 2026-03-19 15:21:28 +00:00
user_api_key_clients_controller.rb FIX: Empty-scopes bypass allows untrusted client registration and downstream scope/redirect policy bypass (#37855) 2026-02-17 12:39:09 +11:00
user_api_keys_controller.rb FIX: Only allow OTPs to be generated from a browser session (#40964) 2026-06-17 18:07:32 +03:00
user_avatars_controller.rb SECURITY: Improve SVG sanitization 2026-06-30 16:10:52 +02:00
user_badges_controller.rb SECURITY: Prevent badge lookup from exposing hidden profiles (#41160) 2026-06-25 13:01:03 +08:00
user_status_controller.rb
users_controller.rb FIX: Validate early for input length in username field on registration (#41525) 2026-07-07 16:27:13 -04:00
users_email_controller.rb FIX: enforces login for create in user emails controller (#37770) 2026-02-12 17:10:43 +01:00
webhooks_controller.rb SECURITY: Prevent any signed AWS SNS TopicARN from being accepted via webhooks 2026-06-30 16:10:52 +02:00
wizard_controller.rb