Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://gh.wpcy.net/https://github.com/discourse/discourse.git synced 2026-06-18 22:05:43 +08:00
Code Packages Activity Actions
discourse/lib/guardian
History
Exact
Isaac Janzen df9b3ac42b
FIX: Post serialization exposes hidden-profile user status messages (#40885) 
## Summary

Fix a bug where users with hidden profiles could still expose their
status in post JSON and `/user-status broadcasts` by consistently
enforcing `Guardian#can_see_user_status?` before serializing or
publishing status updates.

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/1287

Co-authored-by: discourse-patch-triage
<272280883+discourse-patch-triage[bot]@users.noreply.github.com>
2026-06-15 09:25:47 -05:00
..
bookmark_guardian.rb DEV: Consistently use Guardian helper methods (#34024) 2025-08-14 15:23:42 +08:00
category_guardian.rb FEATURE: Support group based category posting review modes (#38707) 2026-04-07 10:41:16 +08:00
ensure_magic.rb
flag_guardian.rb FEATURE: allow edit custom flags (#32344) 2025-04-17 12:31:52 +08:00
group_guardian.rb FEATURE: Split setting for allowing mods to manage categories and groups (#35174) 2025-10-06 10:43:42 +03:00
invite_guardian.rb DEV: Invites destroy_all_expired allows staff to delete any user's expired invites (#38281) 2026-03-05 09:59:48 -06:00
localization_guardian.rb FEATURE: Introduce tag localizations with API, without UI yet (#36754) 2025-12-18 18:25:58 +08:00
permalink_guardian.rb SECURITY: prevent permalink redirects from leaking restricted slugs 2026-01-28 17:11:14 +00:00
post_guardian.rb FIX: Hidden post excerpts can be returned by group activity serializers (#40217) 2026-05-21 15:28:41 +08:00
post_revision_guardian.rb
sidebar_guardian.rb
staff_action_log_guardian.rb SECURITY: Restrict staff action logs visibility for moderators 2026-01-28 17:11:14 +00:00
tag_guardian.rb FIX: Don't auto-remove chat members from logged_in_users group (#40543) 2026-06-03 18:15:32 +02:00
topic_guardian.rb DEV: Enable Style/RedundantParentheses rubocop rule (#40095) 2026-05-19 15:48:09 +02:00
upload_guardian.rb FIX: Enforce secure-upload ACL in AI bot prompt path (#39903) 2026-05-13 09:55:32 +08:00
user_guardian.rb FIX: Post serialization exposes hidden-profile user status messages (#40885) 2026-06-15 09:25:47 -05:00