Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-09 21:45:25 +08:00
Code Packages Activity Actions
discourse/spec/serializers
History
Exact
Chris Alberti bd15d025b2
 SECURITY: Enforce first-post visibility for topic bookmarks (#42321) 
## Summary

Topic bookmark creation, listing, search, and reminder eligibility now
require the first post to be visible to the user. The fix adds an inner
join on the first post with hidden-post filtering to the list query and
delegates creation and visibility checks to `guardian.can_see_post?` on
the first post, preventing an authenticated user from bookmarking a
topic or searching its metadata after the first post is hidden.

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/1530

Co-authored-by: discourse-patch-triage
<272280883+discourse-patch-triage[bot]@users.noreply.github.com>
2026-08-05 12:52:40 -05:00
..
concerns FEATURE: Prevent silenced users from liking and using reactions (#37040) 2026-01-13 13:59:57 +01:00
about_serializer_spec.rb FEATURE: Localizable /about page fields via its settings page (#41123) 2026-06-26 20:41:08 +08:00
admin_category_serializer_spec.rb FEATURE: Category management UI for admins (#41218) 2026-07-15 09:17:25 +10:00
admin_detailed_user_serializer_spec.rb DEV: External IDs, and hidden groups to admins only. Allow moderators to see SSO when the moderators_view_sso_details site setting is enabled (#41496) 2026-08-03 11:25:34 -05:00
admin_plugin_serializer_spec.rb DEV: Enable Rails/FilePath rubocop rule (#40097) 2026-05-19 19:07:54 +02:00
admin_user_action_serializer_spec.rb DEV: Allow fab! without block (#24314) 2023-11-09 16:47:59 -06:00
admin_user_list_serializer_spec.rb DEV: Prefer RSpec primitives for test setup (#42122) 2026-07-30 11:17:22 +08:00
auth_provider_serializer_spec.rb DEV: Add capability to pass an icon setting into auth provider registration (#34584) 2025-08-28 09:14:36 -05:00
basic_group_serializer_spec.rb DEV: Remove full group refreshes from tests (#25414) 2024-01-25 14:28:26 +08:00
basic_group_user_serializer_spec.rb DEV: Allow fab! without block (#24314) 2023-11-09 16:47:59 -06:00
basic_post_serializer_spec.rb FEATURE: Serve localized content in the site's default locale when user's language is unsupported (#36160) 2025-11-21 17:19:04 +08:00
basic_reviewable_flagged_post_serializer_spec.rb DEV: Update the rubocop-discourse gem 2023-06-26 11:41:52 +02:00
basic_reviewable_queued_post_serializer_spec.rb DEV: Update the rubocop-discourse gem 2023-06-26 11:41:52 +02:00
basic_reviewable_serializer_spec.rb DEV: Allow fab! without block (#24314) 2023-11-09 16:47:59 -06:00
basic_reviewable_user_serializer_spec.rb DEV: Allow fab! without block (#24314) 2023-11-09 16:47:59 -06:00
basic_topic_serializer_spec.rb FEATURE: Serve localized content in the site's default locale when user's language is unsupported (#36160) 2025-11-21 17:19:04 +08:00
basic_user_serializer_spec.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
category_detailed_serializer_spec.rb DEV: Apply syntax_tree formatting to spec/* 2023-01-09 11:49:28 +00:00
category_serializer_spec.rb SECURITY: Stop exposing hidden tag names through category serializers 2026-07-28 16:40:22 +02:00
category_upload_serializer_spec.rb DEV: Allow fab! without block (#24314) 2023-11-09 16:47:59 -06:00
color_scheme_serializer_spec.rb FIX: Allow creating new color palettes based on custom palettes (#34351) 2025-08-20 11:58:40 +08:00
component_index_serializer_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
current_user_serializer_spec.rb FEATURE: Allow selection of multiple content languages when viewing topics and posts (#42128) 2026-07-30 12:19:44 +08:00
detailed_user_badge_serializer_spec.rb DEV: Allow fab! without block (#24314) 2023-11-09 16:47:59 -06:00
directory_item_serializer_spec.rb SECURITY: /directory_items leaks restricted user-field values (#41476) 2026-07-06 13:05:48 -05:00
emoji_serializer_spec.rb FEATURE - Add username column to custom emoji table (#29522) 2024-11-01 10:32:59 -05:00
flag_serializer_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
flagged_user_serializer_spec.rb SECURITY: Hide IP from flagged regular users 2026-03-19 15:21:28 +00:00
found_user_serializer_spec.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
group_show_serializer_spec.rb FIX: Ensure moderators do not clear group email domain (#39631) 2026-04-29 14:32:38 +08:00
group_user_serializer_spec.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
group_user_with_custom_fields_serializer_spec.rb FEATURE: Hide user status when user is hiding public profile and presence (#24300) 2024-02-26 17:40:48 +04:00
incoming_email_details_serializer_spec.rb FIX: Remove error section when viewing details for received emails (#35228) 2025-10-07 16:25:11 +08:00
incoming_email_serializer_spec.rb FIX: Remove error section when viewing details for received emails (#35228) 2025-10-07 16:25:11 +08:00
invite_serializer_spec.rb SECURITY: Prevent expired invite details from leaking (#41184) 2026-06-25 22:01:51 +08:00
listable_topic_serializer_spec.rb DEV: Remove 'experimental' prefix from settings (#33233) 2025-06-19 12:23:42 +08:00
nested_replies_basic_category_serializer_spec.rb FEATURE: Add nested replies category conversion (#41236) 2026-07-06 08:22:22 -05:00
new_post_result_serializer_spec.rb DEV: Apply syntax_tree formatting to spec/* 2023-01-09 11:49:28 +00:00
notification_serializer_spec.rb FIX: Notifications may not have topics (#36143) 2025-11-21 01:50:31 +08:00
pending_post_serializer_spec.rb FIX: Attribute pending post to author in PendingPostSerialier (#23369) 2023-09-03 22:14:51 +00:00
post_action_type_serializer_spec.rb FIX: Return properly interpolated translations for flag types 2024-07-30 18:30:57 +02:00
post_item_excerpt_spec.rb FIX: Handle Nokogiri HTML parser limits in PrettyText.excerpt (#37610) 2026-02-06 22:00:54 +01:00
post_localization_serializer_spec.rb FEATURE: Add translations to posts (#32564) 2025-05-08 10:40:36 -07:00
post_revision_serializer_spec.rb FIX: Omit inaccessible reply target post numbers from post revision history (#41547) 2026-07-08 11:41:43 -05:00
post_serializer_spec.rb FEATURE: Allow selection of multiple content languages when viewing topics and posts (#42128) 2026-07-30 12:19:44 +08:00
poster_serializer_spec.rb FIX: Include group flair in homepage category topic lists (#21268) 2023-04-27 10:18:16 +08:00
remote_theme_serializer_spec.rb FIX: Hide broken theme about/license URLs (#29930) 2024-11-26 13:53:10 +10:00
reviewable_claimed_topic_serializer_spec.rb FEATURE: Sync Reviewable Status (#31901) 2025-03-24 14:27:18 +11:00
reviewable_flagged_post_serializer_spec.rb FIX: Show translated post in review queue when present (#40378) 2026-05-29 14:32:11 -04:00
reviewable_note_serializer_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
reviewable_queued_post_serializer_spec.rb SECURITY: Restrict raw email in queued post payloads 2026-05-19 00:26:04 +01:00
reviewable_score_serializer_spec.rb FIX: Preserve safe formatting in reviewable reasons (#42164) 2026-07-30 17:07:08 +02:00
reviewable_serializer_spec.rb FIX: Reviewable Insights Metadata (#42145) 2026-08-05 10:02:27 -05:00
reviewable_user_serializer_spec.rb FEATURE: Allow suspending and silencing users from the review queue (#42205) 2026-07-31 14:47:40 +02:00
sidebar_section_serializer_spec.rb DEV: Prefer RSpec primitives for test setup (#42122) 2026-07-30 11:17:22 +08:00
single_sign_on_record_serializer_spec.rb DEV: Allow fab! without block (#24314) 2023-11-09 16:47:59 -06:00
site_category_serializer_spec.rb SECURITY: Stop exposing hidden tag names through category serializers 2026-07-28 16:40:22 +02:00
site_serializer_spec.rb SECURITY: Stop exposing hidden tag names through category serializers 2026-07-28 16:40:22 +02:00
suggested_topic_serializer_spec.rb FIX: Suggested topic links to nested replies topics (#40302) 2026-05-26 08:40:38 -05:00
tag_group_serializer_spec.rb DEV: Move canonical tag routes to /tag/slug/id keeping /tag/name support (#37055) 2026-02-11 10:21:19 +08:00
tag_serializer_spec.rb FEATURE: Show localized tags (#37044) 2026-02-12 18:06:14 +08:00
theme_index_serializer_spec.rb FEATURE: enhance screenshot support for themes with dark/light modes (#36422) 2025-12-10 11:23:21 +10:00
theme_objects_setting_metadata_serializer_spec.rb DEV: Enable Rails/FilePath rubocop rule (#40097) 2026-05-19 19:07:54 +02:00
theme_serializer_spec.rb FEATURE: enhance screenshot support for themes with dark/light modes (#36422) 2025-12-10 11:23:21 +10:00
theme_settings_serializer_spec.rb DEV: Add disallowed_groups to theme/component settings (#41792) 2026-07-20 09:28:52 +10:00
topic_link_serializer_spec.rb FIX: Filter orphaned TopicLinks and normalize http URLs to https (#37098) 2026-01-15 12:12:34 +08:00
topic_list_item_serializer_spec.rb FEATURE: Notification/tracking changes for nested replies (#39750) 2026-05-07 12:33:56 -05:00
topic_list_serializer_spec.rb FEATURE: Show localized tags (#37044) 2026-02-12 18:06:14 +08:00
topic_tracking_state_item_serializer_spec.rb FIX: Don't emit tag names/slugs in topic tracking state (#40117) 2026-05-19 05:07:17 +08:00
topic_tracking_state_serializer_spec.rb DEV: Allow fab! without block (#24314) 2023-11-09 16:47:59 -06:00
topic_view_details_serializer_spec.rb FIX: DeleteReplies should use the guardian instead of checking for staff (#35443) 2025-10-16 18:26:41 +02:00
topic_view_posts_serializer_spec.rb DEV: Apply syntax_tree formatting to spec/* 2023-01-09 11:49:28 +00:00
topic_view_serializer_spec.rb DEV: Remove per topic toggle (#40869) 2026-06-15 18:43:36 +08:00
upload_serializer_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
user_auth_token_serializer_spec.rb DEV: Enable Rails/FilePath rubocop rule (#40097) 2026-05-19 19:07:54 +02:00
user_badge_serializer_spec.rb DEV: Allow fab! without block (#24314) 2023-11-09 16:47:59 -06:00
user_bookmark_list_serializer_spec.rb SECURITY: Enforce first-post visibility for topic bookmarks (#42321) 2026-08-05 12:52:40 -05:00
user_card_serializer_spec.rb DEV: Tighten featured topic serialization data (#40549) 2026-06-03 16:32:52 -05:00
user_export_serializer_spec.rb FIX: User profile not loading with an empty export (#31290) 2025-02-11 16:18:06 -07:00
user_notification_total_serializer_spec.rb DEV: Dedicated route for current user notification counts (#26106) 2024-03-15 12:08:37 -04:00
user_post_bookmark_serializer_spec.rb DEV: Apply syntax_tree formatting to spec/* 2023-01-09 11:49:28 +00:00
user_serializer_spec.rb FEATURE: Allow selection of multiple content languages when viewing topics and posts (#42128) 2026-07-30 12:19:44 +08:00
user_status_serializer_spec.rb DEV: Allow fab! without block (#24314) 2023-11-09 16:47:59 -06:00
user_summary_serializer_spec.rb FEATURE: allow disabling user activity tab for non admin users (#25540) 2024-02-05 14:30:36 +05:30
user_with_custom_fields_serializer_spec.rb FEATURE: Hide user status when user is hiding public profile and presence (#24300) 2024-02-26 17:40:48 +04:00
web_hook_post_serializer_spec.rb DEV: Post localization improvements (#32869) 2025-05-27 08:49:53 -07:00
web_hook_topic_view_serializer_spec.rb DEV: Allow fab! without block (#24314) 2023-11-09 16:47:59 -06:00
web_hook_user_serializer_spec.rb DEV: Tighten featured topic serialization data (#40549) 2026-06-03 16:32:52 -05:00
wizard_serializer_spec.rb UX: One step wizard (#36082) 2025-11-25 13:35:32 -05:00