mirror of
https://gh.wpcy.net/https://github.com/discourse/discourse.git
synced 2026-05-12 18:43:30 +08:00
47728575f8
The `upload_csv` endpoint accepted user-controlled CSV headers without validation, allowing arbitrary keys into the invite hashes passed to the BulkInvite job. Restrict accepted columns to the ones already handled in BulkInvite ( basically, `email`, `groups`, `topic_id`, `locale`) plus valid UserField names.
118 B
118 B
| 1 | groups | topic_id | admin | moderator | trust_level | |
|---|---|---|---|---|---|---|
| 2 | test@example.com | discourse | true | true | 4 | |
| 3 | test2@example.com | true | 4 |
