Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-06 04:48:33 +08:00
Code Packages Activity Actions
discourse/spec/models
History
Exact
Alan Guo Xiang Tan b6b2a2e602
 SECURITY: Harden ListController top period query against SQL injection (#41718) 
A category's `default_top_period` was interpolated raw into the
top-topic
score predicate in `ListController` before the period was validated
against
the allowlist. For anonymous requests to a category whose default view
is
`top`, an attacker-planted value reached the SQL predicate directly. The
response never returns the query's data, but it changes depending on
whether
an injected condition holds, so an attacker can read data one yes/no
answer at
a time.

This is hardening rather than a critical fix because the column is
`varchar(20)`: PostgreSQL rejects an over-long value, leaving no room
for a
subquery or a second statement. An attacker could only probe one value
at a
time, for example reading the PostgreSQL session role character by
character,
not perform arbitrary reads or writes.

Harden the path in depth:

- Sanitise the category-derived period in `best_period_for`, falling
back to
the site default when it is not a known period, so the untrusted value
never
  reaches SQL.
- Build the score column in `best_period_with_topics_for` through the
validating `TopTopic.score_column_for_period` helper instead of raw
string
  interpolation.
- Clear `Category#default_top_period` on validation when it is not a
known
period, so an invalid value is never stored and the category falls back
to
  the site default at read time.
2026-07-15 12:17:50 +08:00
..
concerns UX: Trust level section functional redesign (#41231) 2026-07-02 13:31:28 +08:00
reports Revert "FEATURE: Surface Direct traffic in the Top referrers dashboard card (#40470)" (#40508) 2026-06-03 10:24:24 +08:00
about_spec.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
access_control_list_spec.rb FEATURE: Support users in DAccessControl and backend (#41358) 2026-07-15 09:18:06 +10:00
admin_dashboard_data_spec.rb DEV: Remove old problem check system - part 2 (#34403) 2025-08-20 16:15:21 +08:00
admin_dashboard_report_spec.rb DEV: Scaffold backend for the new admin dashboard Reports section (#40017) 2026-05-20 09:53:26 +03:00
admin_dashboard_section_spec.rb DEV: Persist dashboard configuration in table and *not* on closure of the dialog (#40546) 2026-06-04 10:53:59 +08:00
admin_notice_spec.rb
api_key_scope_spec.rb DEV: Add tests for intentional granular API key behavior for /about (#39922) 2026-05-12 09:05:11 -05:00
api_key_spec.rb DEV: allow granular api keys access to about.json 2026-04-21 11:06:25 -04:00
application_request_spec.rb
associated_group_spec.rb DEV: fix a large amount of typos (#37428) 2026-02-02 16:31:58 +11:00
badge_grouping_spec.rb
badge_spec.rb FIX: Allow badges with SQL queries to be manually granted (#36866) 2026-01-09 13:58:09 +01:00
badge_type_spec.rb
bookmark_spec.rb FIX: notification reminder is deleted with bookmark (#35141) 2025-10-03 08:34:19 +02:00
browser_pageview_country_daily_rollup_spec.rb PERF: Daily rollups for top countries and top referrers reports (#40285) 2026-05-26 14:35:20 +08:00
browser_pageview_event_spec.rb DEV: Track beacon browser pageviews behind dashboard_improvements (#40934) 2026-06-23 10:21:39 +08:00
browser_pageview_referrer_daily_rollup_spec.rb FIX: Backfill normalized referrer for historical browser pageviews (#40357) 2026-06-09 09:04:57 +08:00
browser_pageview_session_engagement_daily_rollup_spec.rb FEATURE: Show bounce rate and average session duration on the dashboard (#40936) 2026-07-03 10:49:32 +08:00
browser_pageview_session_engagement_spec.rb DEV: Track browser session engagement for crawler detection (#41215) 2026-07-01 09:17:48 +08:00
category_featured_topic_spec.rb
category_group_spec.rb DEV: Enable RSpec/InstanceVariable rule for models 2025-02-17 10:00:08 +01:00
category_list_spec.rb FIX: only show first paragraph of localized category descriptions (#41511) 2026-07-10 16:59:40 -04:00
category_localization_spec.rb FIX: only show first paragraph of localized category descriptions (#41511) 2026-07-10 16:59:40 -04:00
category_posting_review_group_spec.rb FEATURE: Support group based category posting review modes (#38707) 2026-04-07 10:41:16 +08:00
category_scope_site_setting_spec.rb DEV: Introduce a category scope enum for flexible category selection (#41505) 2026-07-08 15:54:10 +08:00
category_setting_spec.rb FEATURE: Add nested replies category conversion (#41236) 2026-07-06 08:22:22 -05:00
category_spec.rb SECURITY: Harden ListController top period query against SQL injection (#41718) 2026-07-15 12:17:50 +08:00
category_tag_stat_spec.rb
category_user_spec.rb FIX: Respect user's manual topic notification level changes (#39037) 2026-04-02 11:05:00 +02:00
child_theme_spec.rb
color_scheme_color_spec.rb
color_scheme_spec.rb FEATURE: Allow editing theme-owned palettes (#34722) 2025-10-06 09:02:39 +03:00
developer_spec.rb
digest_email_site_setting_spec.rb
directory_item_spec.rb PERF: DirectoryItem.refresh! daily can take an extremely long time (#35860) 2025-11-10 13:23:23 +10:00
discourse_connect_spec.rb FIX: Reject DiscourseConnect SSO payloads when secret is blank (#40830) 2026-06-12 15:17:16 +03:00
do_not_disturb_timing_spec.rb
draft_sequence_spec.rb FEATURE: Multiple Draft Topics (#30790) 2025-01-29 10:23:26 +04:00
draft_spec.rb FIX: certain edge cases could leave phantom drafts behind (#37130) 2026-01-16 13:17:18 +11:00
email_change_request_spec.rb
email_log_spec.rb
email_login_code_spec.rb FEATURE: Log in with a one-time email code (#40804) 2026-06-17 12:34:48 -07:00
email_token_spec.rb DEV: Enable RSpec/InstanceVariable rule for models 2025-02-17 10:00:08 +01:00
embeddable_host_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
embeddable_host_tag_spec.rb
emoji_spec.rb FIX: Prevent double-escaping of HTML entities in titles and meta descriptions (#41261) 2026-07-02 20:26:35 +02:00
flag_spec.rb FIX: Ensure each flag gets a unique name_key (#40899) 2026-06-24 16:37:59 +02:00
form_template_spec.rb DEV: Expand top_tags, topic.tags, etc, to return an array of tag objects instead of tag names (#36678) 2026-02-02 10:03:02 +08:00
given_daily_like_spec.rb
global_setting_spec.rb DEV: Allow loading specific plugins in development (#39975) 2026-05-13 14:13:32 +01:00
group_archived_message_spec.rb FIX: Scope group archive and inbox actions to the group's messages (#41662) 2026-07-14 10:05:10 +05:30
group_associated_group_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
group_history_spec.rb
group_request_spec.rb
group_spec.rb FIX: Make auto pseudogroups visible to logged on users (#41498) 2026-07-08 09:28:18 +10:00
group_user_spec.rb PERF: Add Users to Group Improvements Pt. 3 (#39091) 2026-04-20 09:38:16 -05:00
ignored_user_spec.rb FIX: Hide ignored user posts from nested topic view (#39504) 2026-04-28 12:50:09 -05:00
incoming_link_spec.rb
incoming_links_report_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
invite_redeemer_spec.rb PERF: Add Users to Group Improvements Pt. 3 (#39091) 2026-04-20 09:38:16 -05:00
invite_spec.rb FIX: reduce redemption_count when invited user is destroyed (#35695) 2025-10-30 13:43:51 +11:00
javascript_cache_spec.rb
locale_site_setting_spec.rb DEV: Enable Rails/FilePath rubocop rule (#40097) 2026-05-19 19:07:54 +02:00
mailing_list_mode_site_setting_spec.rb
moved_post_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
notification_spec.rb DEV: route nested view through topic route (#40820) 2026-06-15 11:42:20 -05:00
onebox_locale_site_setting_spec.rb FEATURE: Add a onebox_locale site setting. (#30655) 2025-01-09 14:11:37 +11:00
optimized_image_spec.rb SECURITY: Harden imagemagick execution 2026-06-30 16:10:52 +02:00
optimized_video_spec.rb DEV: Ensure optimized videos have the correct acl (#36364) 2025-12-01 19:50:08 -07:00
permalink_spec.rb SECURITY: prevent permalink redirects from leaking restricted slugs 2026-01-28 17:11:14 +00:00
plugin_store_spec.rb
post_action_spec.rb DEV: Restore and update a post_action spec (#39594) 2026-04-28 18:48:50 +02:00
post_action_type_spec.rb DEV: Enable RSpec/InstanceVariable rule for models 2025-02-17 10:00:08 +01:00
post_analyzer_spec.rb
post_detail_spec.rb
post_localization_spec.rb FEATURE: Add support for uploads on translated posts (#35871) 2025-11-12 08:55:21 -08:00
post_mover_spec.rb FIX: Moved reviewable post content leaks to old category moderators (#41041) 2026-06-19 16:31:55 -05:00
post_reply_key_spec.rb
post_reply_spec.rb
post_revision_spec.rb
post_spec.rb FEATURE: Localize local oneboxes (#40493) 2026-06-08 11:49:55 +08:00
post_stripper_spec.rb
post_timing_spec.rb FIX: update PM tracking state when marking messages as unread (#36258) 2025-11-26 18:29:35 +01:00
private_message_topic_tracking_state_spec.rb FEATURE: Exclude small actions from topic counters and unread tracking (#40481) 2026-06-08 08:03:55 +02:00
problem_check_tracker_spec.rb FEATURE: Add problem checks page to admin panel and allow ignoring problem checks (#39103) 2026-04-23 08:28:33 +08:00
published_page_spec.rb
quoted_post_spec.rb
remote_theme_spec.rb FEATURE: Show theme d-compat/* refs in admin UI (#40649) 2026-06-17 22:13:45 +01:00
report_spec.rb DEV: Remove reporting_improvements upcoming change (#41259) 2026-07-01 07:52:02 +08:00
reviewable_claimed_topic_spec.rb FEATURE: Sync Reviewable Status (#31901) 2025-03-24 14:27:18 +11:00
reviewable_flagged_post_spec.rb DEV: document unsilence behavior on disagree_and_restore for category moderators (#39998) 2026-07-02 15:06:56 -05:00
reviewable_history_spec.rb
reviewable_note_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
reviewable_post_spec.rb DEV: Remove reviewable_ui_refresh feature flag and legacy code (#36752) 2026-02-23 10:45:36 +08:00
reviewable_queued_post_spec.rb FEATURE: Link staff action log entries to originating reviewable (#39519) 2026-04-30 09:15:45 +08:00
reviewable_score_spec.rb
reviewable_spec.rb FIX: keeps force_review once set to true (#38795) 2026-03-23 14:57:07 -03:00
reviewable_user_spec.rb Revert "FEATURE: discourse-workflows (#39704)" (#40366) 2026-05-28 13:59:42 +01:00
s3_region_site_setting_spec.rb
screened_email_spec.rb
screened_ip_address_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
screened_url_spec.rb DEV: Enable RSpec/InstanceVariable rule for models 2025-02-17 10:00:08 +01:00
search_log_spec.rb UX: Focus dashboard search analytics on member searches (#41647) 2026-07-13 12:41:19 +08:00
sidebar_section_link_spec.rb
sidebar_section_spec.rb FEATURE: dynamic search when in /filter route (#33614) 2025-07-22 16:08:10 +10:00
sidebar_url_spec.rb
site_setting_localization_spec.rb FEATURE: Localizable /about page fields via its settings page (#41123) 2026-06-26 20:41:08 +08:00
site_setting_spec.rb FIX: Prevent empty top menu configuration (#41710) 2026-07-14 20:36:02 -03:00
site_spec.rb FIX: Make auto pseudogroups visible to logged on users (#41498) 2026-07-08 09:28:18 +10:00
sitemap_spec.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
skipped_email_log_spec.rb
stat_spec.rb FIX: Stat type grouping (#40783) 2026-06-11 16:59:33 +10:00
stylesheet_cache_spec.rb
tag_group_spec.rb FIX: Enforce tag group permissions for non-admin staff (#37377) 2026-01-29 18:06:38 +08:00
tag_localization_spec.rb FIX: Clean localized tag names (#38488) 2026-03-12 12:54:50 +08:00
tag_spec.rb FEATURE: Prioritize recently used tags in the composer tag picker (#41669) 2026-07-14 13:17:18 +02:00
tag_user_spec.rb FIX: Respect user's manual topic notification level changes (#39037) 2026-04-02 11:05:00 +02:00
theme_field_spec.rb DEV: Add resolve_group_membership functionality to theme settings (#41360) 2026-07-08 09:29:21 +10:00
theme_modifier_set_spec.rb
theme_setting_spec.rb FIX: type: objects uploads should be stored as IDs (#40178) 2026-05-21 13:45:27 -03:00
theme_settings_migration_spec.rb
theme_site_setting_spec.rb DEV: Refactor and add missing tests for upload type in objects schema (#36285) 2025-11-28 04:02:23 +08:00
theme_spec.rb DEV: Add resolve_group_membership functionality to theme settings (#41360) 2026-07-08 09:29:21 +10:00
theme_svg_sprite_spec.rb
top_menu_item_spec.rb
top_topic_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
topic_allowed_user_spec.rb
topic_converter_spec.rb FIX: keep private message conversion limited to staff (#41460) 2026-07-06 14:13:48 +05:30
topic_embed_spec.rb FIX: Embed not loading when canonical URL points to different host due to discourseEmbedUrl not being used (#39647) 2026-05-11 21:06:29 -05:00
topic_featured_users_spec.rb
topic_group_spec.rb DEV: Enable RSpec/InstanceVariable rule for models 2025-02-17 10:00:08 +01:00
topic_hot_scores_spec.rb FIX: Exclude unlisted topics from hot scores (#37312) 2026-01-27 13:46:57 +11:00
topic_invite_spec.rb
topic_link_click_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
topic_link_spec.rb FIX: Honor silent=true on internal links with other query params (#41365) 2026-07-02 16:51:44 +02:00
topic_list_spec.rb DEV: Expand top_tags, topic.tags, etc, to return an array of tag objects instead of tag names (#36678) 2026-02-02 10:03:02 +08:00
topic_localization_spec.rb DEV: Add rake task to backfill localization excerpts which were empty (#36901) 2025-12-30 17:04:36 +08:00
topic_participant_groups_summary_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
topic_participants_summary_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
topic_posters_summary_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
topic_spec.rb DEV: Apply different first-day limits for TL0 and TL1 (#41433) 2026-07-03 14:08:05 -04:00
topic_tag_spec.rb
topic_thumbnail_spec.rb FEATURE: Add animated_topic_thumbnails site setting (#39165) 2026-04-08 23:51:01 +02:00
topic_timer_spec.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
topic_tracking_state_spec.rb DEV: Bump unified new upcoming change to Beta (#41454) 2026-07-08 09:50:19 +10:00
topic_user_spec.rb DEV: Enable Style/RedundantBegin rubocop rule (#40096) 2026-05-19 18:44:54 +02:00
topic_view_item_spec.rb
translation_override_spec.rb UX: Display interpolation keys as interactive pills in admin editors (#37254) 2026-02-27 21:21:26 +01:00
trust_level3_requirements_spec.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
trust_level_and_staff_setting_spec.rb
trust_level_setting_spec.rb DEV: Fix flaky deprecated setting specs (#30550) 2025-01-04 12:55:22 +01:00
unsubscribe_key_spec.rb
upload_reference_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
upload_spec.rb DEV: Enable Style/RedundantBegin rubocop rule (#40096) 2026-05-19 18:44:54 +02:00
user_action_spec.rb SECURITY: Restrict user action removal messages (#41405) 2026-07-03 17:56:04 +08:00
user_api_key_spec.rb FEATURE: User API key device authorization flow (#40189) 2026-06-10 16:09:44 -04:00
user_archived_message_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
user_associated_group_spec.rb FIX: Do not remove user from group with no association inadvertently (#39854) 2026-05-08 12:48:56 -04:00
user_auth_token_spec.rb SECURITY: Bind shared session key to auth token and enforce user gates (#41610) 2026-07-14 13:25:05 +08:00
user_avatar_spec.rb DEV: ensure rebaking works even when some users have inconsistent data (#30261) 2024-12-16 19:48:25 +08:00
user_badge_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
user_bookmark_list_spec.rb
user_custom_field_spec.rb FIX: Searchable user fields do not always have an integer name (#30223) 2024-12-17 11:06:19 +11:00
user_email_spec.rb FIX: allow users with normalized emails to change emails and remove + / . (#37133) 2026-01-16 07:36:58 +11:00
user_export_spec.rb FEATURE: Allow admins to export users (#30918) 2025-01-24 08:13:25 +11:00
user_field_spec.rb
user_history_spec.rb SECURITY: Restrict staff action logs visibility for moderators 2026-01-28 17:11:14 +00:00
user_notification_schedule_spec.rb
user_option_spec.rb FEATURE: Convert watched_precedence_over_muted to default site setting (#35671) 2025-10-30 10:04:18 +10:00
user_password_spec.rb FIX: setting new password should reset password_expired_at (#29296) 2024-10-21 07:24:43 +08:00
user_profile_spec.rb
user_profile_view_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
user_search_spec.rb FIX: Enforce group visibility when filtering users by group (#41370) 2026-07-03 07:08:52 +02:00
user_second_factor_spec.rb
user_security_key_spec.rb
user_spec.rb FEATURE: Change default upcoming change promotion status to Beta (#41275) 2026-07-06 09:13:37 +10:00
user_stat_spec.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
user_status_spec.rb
user_summary_spec.rb SECURITY: Replying to a whisper lets non-whisperers create staff-only whisper posts 2026-05-19 00:26:04 +01:00
user_visit_spec.rb PERF: Rewrite DAU/MAU rolling count as a non-correlated sweep (#40692) 2026-06-10 17:21:49 +08:00
username_validator_spec.rb DEV: Enable Style/RedundantParentheses rubocop rule (#40095) 2026-05-19 15:48:09 +02:00
watched_word_group_spec.rb
watched_word_spec.rb
web_crawler_request_spec.rb
web_hook_event_spec.rb
web_hook_event_type_spec.rb FEAT: add webhooks for calendar events (#38315) 2026-03-09 12:30:19 -05:00
web_hook_events_daily_aggregate_spec.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
web_hook_spec.rb PERF: Add Users to Group Pt. 1 (#38737) 2026-03-26 09:11:22 -05:00