..
admin
UX: Display interpolation keys as interactive pills in admin editors ( #37254 )
2026-02-27 21:21:26 +01:00
users
FIX: Revocation endpoint is blocked when login_required is enabled, preventing session invalidation ( #37859 )
2026-02-17 09:12:14 -05:00
about_controller.rb
application_controller.rb
FEATURE: Full Ember app embed mode for blog comments ( #36613 )
2026-02-18 18:22:57 -03:00
associated_groups_controller.rb
badges_controller.rb
FIX: Non-listable and disabled badges exposed via XHR JSON requests ( #37869 )
2026-02-17 16:17:01 +11:00
bookmarks_controller.rb
DEV: Update rubocop-discourse to 3.13 and autofix issues ( #35073 )
2025-10-06 16:11:01 +02:00
bootstrap_controller.rb
DEV: Refactor plugin JS handling ( #37763 )
2026-02-19 12:24:04 +00:00
categories_controller.rb
FEATURE: add category type configuration system ( #37929 )
2026-02-27 13:20:17 +10:00
clicks_controller.rb
composer_controller.rb
FIX: correct Discourse.InvalidParameters usage ( #37690 )
2026-02-11 10:28:12 +01:00
composer_messages_controller.rb
dev_mode_controller.rb
DEV: Add /dev-mode endpoint for MiniProfiler auth cookie ( #37027 )
2026-01-12 10:01:20 +08:00
directory_columns_controller.rb
directory_items_controller.rb
SECURITY: Filter private user fields in directory items endpoint
2026-02-26 12:22:54 +00:00
do_not_disturb_controller.rb
drafts_controller.rb
DEV: Expand top_tags, topic.tags, etc, to return an array of tag objects instead of tag names ( #36678 )
2026-02-02 10:03:02 +08:00
edit_directory_columns_controller.rb
email_controller.rb
FEATURE: implement RFC 8058 for email unsubscribe ( #33392 )
2025-07-01 11:01:13 +10:00
embed_controller.rb
FEATURE: Full Ember app embed mode for blog comments ( #36613 )
2026-02-18 18:22:57 -03:00
emojis_controller.rb
DEV: discourse-emojis gem ( #31408 )
2025-03-03 13:09:08 +01:00
exceptions_controller.rb
export_csv_controller.rb
FIX: Missing requires_login — authentication relies solely on guardian call ( #37716 )
2026-02-11 12:25:58 +01:00
extra_locales_controller.rb
DEV: Refactor locale bundle loading ( #37114 )
2026-01-16 11:45:14 +00:00
finish_installation_controller.rb
FIX: Redirect to wizard when setting up new instance using Discourse ID ( #36993 )
2026-01-07 10:19:17 -05:00
form_templates_controller.rb
DEV: Rename experimental_ upcoming change settings ( #37589 )
2026-02-10 10:34:37 +10:00
forums_controller.rb
DEV: Update rubocop-discourse to 3.13 and autofix issues ( #35073 )
2025-10-06 16:11:01 +02:00
groups_controller.rb
FIX: Enforce allow_membership_requests setting in groups controller ( #38017 )
2026-02-24 14:11:32 +01:00
hashtags_controller.rb
highlight_js_controller.rb
home_page_controller.rb
DEV: Show login-required splash in root route (take 2) ( #32629 )
2025-05-14 11:25:43 -04:00
inline_onebox_controller.rb
DEV: Update rubocop-discourse to 3.13 and autofix issues ( #35073 )
2025-10-06 16:11:01 +02:00
invites_controller.rb
FIX: update and create_multiple actions missing from requires_login ( #37715 )
2026-02-11 12:21:32 +01:00
list_controller.rb
FIX: Standardize Unicode encoding for route params in construct_url_with ( #37843 )
2026-02-16 18:08:05 +01:00
metadata_controller.rb
DEV: Update rubocop-discourse to 3.13 and autofix issues ( #35073 )
2025-10-06 16:11:01 +02:00
new_invite_controller.rb
new_topic_controller.rb
notifications_controller.rb
FIX: Hide badge notifications for disabled badges or when badges are disabled ( #36987 )
2026-01-07 15:28:43 +08:00
offline_controller.rb
onebox_controller.rb
DEV: Update rubocop-discourse to 3.13 and autofix issues ( #35073 )
2025-10-06 16:11:01 +02:00
pageview_controller.rb
permalinks_controller.rb
SECURITY: prevent permalink redirects from leaking restricted slugs
2026-01-28 17:11:14 +00:00
post_action_users_controller.rb
FIX: likes are not visible when rejecting PMs ( #35753 )
2025-11-03 16:23:32 +11:00
post_actions_controller.rb
FIX: prevents destroy post action to leak post ( #38015 )
2026-02-24 11:15:06 +01:00
post_localizations_controller.rb
FIX: Also check if user can see post or topic prior to letting them localize it ( #36749 )
2025-12-18 02:12:58 +08:00
post_readers_controller.rb
posts_controller.rb
UX: When diffs error, show a nicer UI ( #38104 )
2026-02-27 10:53:26 -05:00
presence_controller.rb
FIX: improve "read only" modes ( #33521 )
2025-07-10 09:08:00 +02:00
published_pages_controller.rb
FIX: ensures only staff can check slugs ( #37846 )
2026-02-16 18:23:46 +01:00
push_notification_controller.rb
qunit_controller.rb
DEV: Refactor plugin JS handling ( #37763 )
2026-02-19 12:24:04 +00:00
reviewable_claimed_topics_controller.rb
FIX: Only log unclaimed history when topic was claimed ( #36949 )
2026-01-06 14:52:55 +08:00
reviewable_notes_controller.rb
SECURITY: scope reviewable notes to user-visible reviewables
2026-02-26 12:22:54 +00:00
reviewables_controller.rb
FIX: Keep reviewable pending when penalized user deletes flagged post ( #36873 )
2026-01-19 10:37:19 +01:00
robots_txt_controller.rb
DEV: Update link to comment in robots.txt as 'allow' is allowed ( #33227 )
2025-06-18 13:30:26 +08:00
safe_mode_controller.rb
FIX: Set X-Robots-Tag header to prevent indexing of /safe-mode ( #32329 )
2025-04-16 16:51:32 +10:00
search_controller.rb
FIX: exclude 't' shortcut from min length bypass ( #37440 )
2026-02-05 06:58:19 +11:00
session_controller.rb
FIX: Passkey login not outputting error messages with suspended user and screened IP checks ( #37827 )
2026-02-16 09:28:03 -05:00
sidebar_sections_controller.rb
FIX: raise 404 when sidebar section doesn't exist ( #37675 )
2026-02-10 15:47:49 +01:00
similar_topics_controller.rb
site_controller.rb
SECURITY: Preload data only when rendering application layout
2025-02-04 13:32:30 -03:00
sitemap_controller.rb
slugs_controller.rb
static_controller.rb
FIX: Path boundary check in serve_asset can escape intended public/assets directory boundary ( #37863 )
2026-02-18 07:17:11 +11:00
steps_controller.rb
UX: One step wizard ( #36082 )
2025-11-25 13:35:32 -05:00
stylesheets_controller.rb
DEV: Update rubocop-discourse to 3.13 and autofix issues ( #35073 )
2025-10-06 16:11:01 +02:00
svg_sprite_controller.rb
DEV: Update rubocop-discourse to 3.13 and autofix issues ( #35073 )
2025-10-06 16:11:01 +02:00
tag_groups_controller.rb
FIX: Include tag slug in tag groups search response ( #37751 )
2026-02-12 15:06:56 +08:00
tag_localizations_controller.rb
FEATURE: Introduce tag localizations with API, without UI yet ( #36754 )
2025-12-18 18:25:58 +08:00
tags_controller.rb
DEV: Setup backend for dedicated tag settings page ( #37804 )
2026-02-13 17:14:49 +08:00
test_requests_controller.rb
DEV: Add a user agent to all HTTP requests that Discourse makes. ( #31555 )
2025-03-03 16:32:25 +11:00
theme_javascripts_controller.rb
DEV: Manually fix Rails/UnusedRenderContent offenses ( #34418 )
2025-08-22 11:42:12 +02:00
topic_localizations_controller.rb
UX: Use inline title editor instead of composer when editing translation ( #36847 )
2025-12-24 00:56:36 +08:00
topic_view_stats_controller.rb
topics_controller.rb
SECURITY: Prevent TL4 users to post to staff-only categories through a topic timer
2026-02-26 12:22:54 +00:00
uploads_controller.rb
FIX: Multisite prevent anons from downloading files ( #37979 )
2026-02-24 10:49:14 +10:00
user_actions_controller.rb
user_api_key_clients_controller.rb
FIX: Empty-scopes bypass allows untrusted client registration and downstream scope/redirect policy bypass ( #37855 )
2026-02-17 12:39:09 +11:00
user_api_keys_controller.rb
DEV: Do not show auth_redirect note for discourse://auth_redirect ( #37212 )
2026-01-20 09:29:38 -05:00
user_avatars_controller.rb
PERF: extract shared DiskCacheEviction utility for disk caches ( #37842 )
2026-02-16 12:24:38 +01:00
user_badges_controller.rb
FIX: enforces logged in, in badges actions ( #37666 )
2026-02-10 12:00:56 +01:00
user_status_controller.rb
users_controller.rb
DEV: toggle_anon missing from requires_login ( #37644 )
2026-02-10 08:36:27 +11:00
users_email_controller.rb
FIX: enforces login for create in user emails controller ( #37770 )
2026-02-12 17:10:43 +01:00
webhooks_controller.rb
SECURITY: harden webooks endpoints
2026-02-26 12:22:54 +00:00
wizard_controller.rb