0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-10 23:59:31 +08:00
discourse/spec/requests
Régis Hanol 8ba7a6448b
FIX: Trailing small actions could appear perpetually unread
Excluding small actions from a topic's counters (#40481) also excluded them
from `highest_post_number` / `highest_staff_post_number`, which are the ceiling
that `topic_users.last_read_post_number` is clamped to. As a result, a topic
whose last post is a small action (a close, pin, archive, etc. notice) could
never be read past that notice: the "last visit" line stayed above it on every
visit and the topic never read as fully caught up
(https://meta.discourse.org/t/-/404058).

The root cause is that `highest_post_number` quietly served two roles — the
highest post worth *notifying* about, and the highest post a user can *see*
(the read-position ceiling). Those were only ever the same value because small
actions used to count toward both. Dropping them from the columns is correct
for the first role but wrong for the second: small actions are visible to
everyone and occupy real stream positions that get read.

This keeps the columns meaning "highest notify-worthy post" — so `/unread`, the
unread badge, and watched notifications stay correct and cheap — and derives
"highest post in the visible stream" wherever a read position is written. That
value includes small actions (and whispers only for whisperers) and lives in
`Topic.highest_post_number_in_stream`; every read-tracking path now goes through
it: recording timings, the `last_read` clamp, `reset_highest`, `dismiss_posts`,
the close/auto-close `pretend_read` target, nested-topic catch-up, and the
post-merge caught-up detection.

Because `last_read_post_number` can now legitimately exceed the notify counter,
a few checks that assumed the two were equal became `>=` (the private-message
read indicator, the topic model's `visited` / `canClearPin`, and the client-side
tracking state).

Finally, `process_timings` computes the visible-stream ceiling once and threads
it into `update_last_read`, so the clamp no longer re-derives it and the hottest
read path stays a single index-backed `MAX(post_number)`.
2026-07-16 09:52:34 +02:00
..
admin FIX: Don't fail the dashboard when one section errors (#41720) 2026-07-15 17:20:51 +08:00
api FEATURE: Support users in DAccessControl and backend (#41358) 2026-07-15 09:18:06 +10:00
examples
about_controller_spec.rb FEATURE: Localizable /about page fields via its settings page (#41123) 2026-06-26 20:41:08 +08:00
access_control_lists_controller_spec.rb FEATURE: Support users in DAccessControl and backend (#41358) 2026-07-15 09:18:06 +10:00
anonymous_actions_controller_spec.rb FEATURE: Prompt anonymous users to sign up after engagement clicks (#40256) 2026-05-26 09:30:38 +02:00
application_controller_spec.rb SECURITY: Bind shared session key to auth token and enforce user gates (#41610) 2026-07-14 13:25:05 +08:00
associate_accounts_controller_spec.rb
badges_controller_spec.rb FEATURE: Add a granular API key scope to list badges (#41086) 2026-06-22 18:32:02 +02:00
bookmarks_controller_spec.rb
calendar_subscriptions_controller_spec.rb FEATURE: Add calendar subscription URLs to user preferences (#38598) 2026-03-17 10:28:20 -03:00
categories_controller_spec.rb FEATURE: Add nested replies category conversion (#41236) 2026-07-06 08:22:22 -05:00
clicks_controller_spec.rb SECURITY: Missing visibility check in click tracking endpoint (#41140) 2026-06-24 15:15:56 +10:00
composer_controller_spec.rb SECURITY: Respect group member visibility for counts (#41403) 2026-07-06 12:48:06 +08:00
composer_messages_controller_spec.rb SECURITY: Whisper metadata disclosure via stale TopicLinks (#41139) 2026-06-24 14:44:27 +10:00
crawler_hreflang_spec.rb UX: Prevent incomplete crawler localization settings (#41297) 2026-07-01 12:13:22 +08:00
default_headers_spec.rb
dev_mode_controller_spec.rb
directory_columns_controller_spec.rb
directory_items_controller_spec.rb SECURITY: Private UserField value disclosure via directory_items order sort side-channel (#41598) 2026-07-09 21:52:51 -05:00
discourse_id_controller_spec.rb FIX: Revocation endpoint is blocked when login_required is enabled, preventing session invalidation (#37859) 2026-02-17 09:12:14 -05:00
do_not_disturb_controller_spec.rb
drafts_controller_spec.rb FIX: Drafts/reviewables API returned 404 when acting on own resource (#39449) 2026-05-26 09:29:20 +02:00
edit_directory_columns_controller_spec.rb
email_controller_spec.rb
embed_controller_spec.rb FIX: Add visibility check to Embed info (#40896) 2026-06-15 10:20:56 -05:00
emojis_controller_spec.rb FEATURE: Locale-specific emoji search aliases (#39089) 2026-04-06 14:08:46 -03:00
exceptions_controller_spec.rb
export_csv_controller_spec.rb FIX: Suspicious login IPs bypass the moderator IP-visibility setting (#40154) 2026-05-22 13:22:32 +08:00
extra_locales_controller_spec.rb
finish_installation_controller_spec.rb
form_templates_controller_spec.rb SECURITY: Scope form template endpoints to accessible categories 2026-05-19 00:26:04 +01:00
forums_controller_spec.rb
gifs_controller_spec.rb FIX: move klipy gifs request to backend (#41540) 2026-07-08 17:18:42 +04:00
groups_controller_spec.rb FIX: Make auto pseudogroups visible to logged on users (#41498) 2026-07-08 09:28:18 +10:00
hashtags_controller_spec.rb
highlightjs_controller_spec.rb
home_page_controller_spec.rb FEATURE: Allow fallback home routes for crawlers for custom homepage sites (#41234) 2026-06-29 09:57:40 -04:00
inline_onebox_controller_spec.rb SECURITY: Check topic visibility in Oneboxer even when categories match 2026-03-31 15:12:45 +01:00
invites_controller_spec.rb FIX: Reject DiscourseConnect SSO payloads when secret is blank (#40830) 2026-06-12 15:17:16 +03:00
list_controller_spec.rb SECURITY: Harden ListController top period query against SQL injection (#41718) 2026-07-15 12:17:50 +08:00
metadata_controller_spec.rb FEATURE: Accept shared files via the Web Share Target (#41030) 2026-06-18 17:35:09 -03:00
nested_topics_controller_spec.rb FIX: Trailing small actions could appear perpetually unread 2026-07-16 09:52:34 +02:00
net_http_header_spec.rb
net_http_timeout_spec.rb DEV: fix a large amount of typos (#37428) 2026-02-02 16:31:58 +11:00
noscript_escape_spec.rb
notifications_controller_spec.rb
offline_controller_spec.rb
omniauth_callbacks_controller_spec.rb FEATURE: Allow HTML for OAuth error message (#41204) 2026-06-26 08:35:06 -05:00
onebox_controller_spec.rb SECURITY: prevent hidden profile data leak via user onebox 2026-03-19 15:21:28 +00:00
permalinks_controller_spec.rb
post_action_users_controller_spec.rb UX: Ignored users reactions/likes should not show up (#39672) 2026-05-11 15:32:29 -03:00
post_actions_controller_spec.rb SECURITY: fix is_warning type coercion bypass in PostActionsController 2026-03-19 15:21:28 +00:00
post_localizations_controller_spec.rb
post_readers_controller_spec.rb SECURITY: Missing post-level authorization allows whisper metadata disclosure 2026-03-31 15:12:45 +01:00
posts_controller_spec.rb FIX: Omit inaccessible reply target post numbers from post revision history (#41547) 2026-07-08 11:41:43 -05:00
presence_controller_spec.rb
published_pages_controller_spec.rb FIX: ensures only staff can check slugs (#37846) 2026-02-16 18:23:46 +01:00
push_notification_controller_spec.rb
qunit_controller_spec.rb DEV: Cache AssetProcessor code in development (#38036) 2026-02-25 11:24:41 +00:00
reviewable_claimed_topics_controller_spec.rb SECURITY: Require topic visibility for category group moderator actions 2026-05-19 00:26:04 +01:00
reviewable_notes_controller_spec.rb SECURITY: scope reviewable notes to user-visible reviewables 2026-02-26 12:22:54 +00:00
reviewables_controller_spec.rb FEATURE: Allow user to delete their pending topic/post at activity page (#41144) 2026-07-14 09:33:35 +02:00
robots_txt_controller_spec.rb
safe_mode_controller_spec.rb
search_controller_spec.rb SECURITY: Apply category tag visibility to full-text search (#41668) 2026-07-13 15:16:26 -03:00
session_controller_spec.rb DEV: Introduce enable_local_logins_via_code as an alpha upcoming change (#41624) 2026-07-10 10:19:27 -07:00
sidebar_sections_controller_spec.rb FIX: raise 404 when sidebar section doesn't exist (#37675) 2026-02-10 15:47:49 +01:00
similar_topics_controller_spec.rb
site_controller_spec.rb DEV: Gate read-restricted banner topics (#38496) 2026-03-11 08:14:57 -07:00
sitemap_controller_spec.rb
slugs_controller_spec.rb
static_controller_spec.rb FIX: Localize static topic pages … (#41260) 2026-06-29 21:34:17 +08:00
steps_controller_spec.rb
stylesheets_controller_spec.rb DEV: Allow plugins to register admin-panel-specific CSS (#40345) 2026-05-28 11:03:38 +01:00
svg_sprite_controller_spec.rb
tag_groups_controller_spec.rb FIX: Prevent tag group from saving if private + no group selected (#39599) 2026-04-29 12:10:45 +08:00
tag_localizations_controller_spec.rb FIX: Clean localized tag names (#38488) 2026-03-12 12:54:50 +08:00
tags_controller_spec.rb FEATURE: Prioritize recently used tags in the composer tag picker (#41669) 2026-07-14 13:17:18 +02:00
theme_import_map_spec.rb DEV: Improve cross-plugin/theme import handling (#40939) 2026-06-30 16:11:38 +01:00
theme_javascripts_controller_spec.rb PERF: Move theme settings from js bundle to preload data (#40137) 2026-06-08 16:04:56 +01:00
topic_localizations_controller_spec.rb
topic_view_stats_controller_spec.rb
topics_controller_spec.rb SECURITY: detailed_404 Security Setting Bypassed (#41549) 2026-07-09 10:58:07 -05:00
uploads_controller_multisite_spec.rb FIX: Multisite prevent anons from downloading files (#37979) 2026-02-24 10:49:14 +10:00
uploads_controller_spec.rb FIX: Serve inline-safe uploads inline on the local file store (#40739) 2026-07-14 18:52:35 +01:00
user_actions_controller_spec.rb FEATURE: Change default upcoming change promotion status to Beta (#41275) 2026-07-06 09:13:37 +10:00
user_api_key_clients_controller_spec.rb FIX: Empty-scopes bypass allows untrusted client registration and downstream scope/redirect policy bypass (#37855) 2026-02-17 12:39:09 +11:00
user_api_keys_controller_spec.rb FIX: Only allow OTPs to be generated from a browser session (#40964) 2026-06-17 18:07:32 +03:00
user_avatars_controller_spec.rb SECURITY: Improve SVG sanitization 2026-06-30 16:10:52 +02:00
user_badges_controller_spec.rb SECURITY: Prevent badge lookup from exposing hidden profiles (#41160) 2026-06-25 13:01:03 +08:00
user_status_controller_spec.rb FIX: Post serialization exposes hidden-profile user status messages (#40885) 2026-06-15 09:25:47 -05:00
users_controller_spec.rb FIX: Validate early for input length in username field on registration (#41525) 2026-07-07 16:27:13 -04:00
users_email_controller_spec.rb DEV: CSRF Token Not Invalidated After Password Reset (#40998) 2026-06-17 16:07:30 -04:00
webhooks_controller_spec.rb SECURITY: Prevent any signed AWS SNS TopicARN from being accepted via webhooks 2026-06-30 16:10:52 +02:00
wizard_controller_spec.rb